CVE-2021-47634: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl

Published Feb 26, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ubi: Fix race condition between ctrlcdevioctl and ubicdevioctl

Hulk Robot reported a KASAN report about use-after-free: ================================================================== BUG: KASAN: use-after-free in listdelentryvalid+0x13d/0x160 Read of size 8 at addr ffff888035e37d98 by task ubiattach/1385 [...] Call Trace: klistdecanddel+0xa7/0x4a0 klistput+0xc7/0x1a0 devicedel+0x4d4/0xed0 cdevdevicedel+0x1a/0x80 ubiattachmtddev+0x2951/0x34b0 [ubi] ctrlcdevioctl+0x286/0x2f0 [ubi]

Allocated by task 1414: deviceadd+0x60a/0x18b0 cdevdeviceadd+0x103/0x170 ubicreatevolume+0x1118/0x1a10 [ubi] ubicdevioctl+0xb7f/0x1ba0 [ubi]

Freed by task 1385: cdevdevicedel+0x1a/0x80 ubiremovevolume+0x438/0x6c0 [ubi] ubicdevioctl+0xbf4/0x1ba0 [ubi] [...] ==================================================================

The lock held by ctrlcdevioctl is ubidevicesmutex, but the lock held by ubicdevioctl is ubi->devicemutex. Therefore, the two locks can be concurrent.

ctrlcdevioctl contains two operations: ubiattach and ubidetach. ubidetach is bug-free because it uses reference counting to prevent concurrency. However, uifinit and uifclose in ubiattach may race with ubicdevioctl.

uifinit will race with ubicdevioctl as in the following stack. cpu1 cpu2 cpu3 || ctrlcdevioctl ubiattachmtddev uifinit ubicdevioctl ubicreatevolume cdevdeviceadd ubiaddvolume // sysfs exist killvolumes ubicdevioctl ubiremovevolume cdevdevicedel // first free ubifreevolume cdevdel // double free cdevdevicedel

And uifclose will race with ubicdevioctl as in the following stack. cpu1 cpu2 cpu3 || ctrlcdevioctl ubiattachmtddev uifinit ubicdevioctl ubicreatevolume cdevdeviceadd ubidebugfsinitdev //error goto outuif; uifclose killvolumes ubicdevioctl ubiremovevolume cdevdevicedel // first free ubifreevolume // double free

The cause of this problem is that commit 714fb87e8bc0 make device "available" before it becomes accessible via sysfs. Therefore, we roll back the modification. We will fix the race condition between ubi device creation and udev by removing ubigetdevice in volattributeshow and devattributeshow.This avoids accessing uninitialized ubidevices[ubinum].

ubigetdevice is used to prevent devices from being deleted during sysfs execution. However, now kernfs ensures that devices will not be deleted before all reference counting are released. The key process is shown in the following stack.

devicedel deviceremoveattrs deviceremovegroups sysfsremovegroups sysfsremovegroup removefiles kernfsremovebyname kernfsremovebynamens kernfsremove kernfsdrain

Affected Software

163 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=3.2.84<3.3
Linux Linux kernel>=3.10.103<3.11
Linux Linux kernel>=3.12.63<3.13
Linux Linux kernel>=3.14.77<3.15
Linux Linux kernel>=3.16.39<3.17
Linux Linux kernel>=3.18.40<3.19
Linux Linux kernel>=4.1.31<4.2
Linux Linux kernel>=4.4.19<4.5
Linux Linux kernel>=4.7.2<4.14.276
Linux Linux kernel>=4.15<4.19.238
Linux Linux kernel>=4.20<5.4.189
Linux Linux kernel>=5.5<5.10.110
Linux Linux kernel>=5.11<5.15.33
Linux Linux kernel>=5.16<5.16.19
Linux Linux kernel>=5.17<5.17.2
ubuntu/linux-azure<4.15.0-1146.161~14.04.1
4.15.0-1146.161~14.04.1
ubuntu/linux-aws<4.4.0-1150.156
4.4.0-1150.156
ubuntu/linux-lts-xenial<4.4.0-276.310~14.04.1
4.4.0-276.310~14.04.1
ubuntu/linux<4.4.0-276.310
4.4.0-276.310
ubuntu/linux-aws<4.4.0-1188.203
4.4.0-1188.203
ubuntu/linux-aws-hwe<4.15.0-1137.148~16.04.1
4.15.0-1137.148~16.04.1
ubuntu/linux-azure<4.15.0-1146.161~16.04.1
4.15.0-1146.161~16.04.1
ubuntu/linux-gcp<4.15.0-1131.147~16.04.1
4.15.0-1131.147~16.04.1
ubuntu/linux-hwe<4.15.0-189.200~16.04.1
4.15.0-189.200~16.04.1
ubuntu/linux-kvm<4.4.0-1151.162
4.4.0-1151.162
ubuntu/linux-oracle<4.15.0-1102.113~16.04.1
4.15.0-1102.113~16.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-fips<4.4.0-1120.127
4.4.0-1120.127
ubuntu/linux-fips*
ubuntu/linux<4.15.0-189.200
4.15.0-189.200
ubuntu/linux-aws<4.15.0-1137.148
4.15.0-1137.148
ubuntu/linux-aws-5.4<5.4.0-1078.84~18.04.1
5.4.0-1078.84~18.04.1
ubuntu/linux-azure-4.15<4.15.0-1146.161
4.15.0-1146.161
ubuntu/linux-azure-5.4<5.4.0-1083.87~18.04.1
5.4.0-1083.87~18.04.1
ubuntu/linux-gcp-4.15<4.15.0-1131.147
4.15.0-1131.147
ubuntu/linux-gcp-5.4<5.4.0-1078.84~18.04.1
5.4.0-1078.84~18.04.1
ubuntu/linux-hwe-5.4<5.4.0-117.132~18.04.1
5.4.0-117.132~18.04.1
ubuntu/linux-ibm-5.4<5.4.0-1028.32~18.04.1
5.4.0-1028.32~18.04.1
ubuntu/linux-kvm<4.15.0-1123.128
4.15.0-1123.128
ubuntu/linux-oracle<4.15.0-1102.113
4.15.0-1102.113
ubuntu/linux-oracle-5.4<5.4.0-1076.83~18.04.1
5.4.0-1076.83~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1065.75~18.04.1
5.4.0-1065.75~18.04.1
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-fips<4.15.0-2076.81
4.15.0-2076.81
ubuntu/linux-azure-fips<4.15.0-2057.63
4.15.0-2057.63
ubuntu/linux-fips<4.15.0-1094.105
4.15.0-1094.105
ubuntu/linux-gcp-fips<4.15.0-2041.46
4.15.0-2041.46
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-117.132
5.4.0-117.132
ubuntu/linux-aws<5.4.0-1078.84
5.4.0-1078.84
ubuntu/linux-azure<5.4.0-1083.87
5.4.0-1083.87
ubuntu/linux-azure-5.15<5.15.0-1008.9~20.04.1
5.15.0-1008.9~20.04.1
ubuntu/linux-bluefield<5.4.0-1040.44
5.4.0-1040.44
ubuntu/linux-gcp<5.4.0-1078.84
5.4.0-1078.84
ubuntu/linux-hwe-5.15<5.15.0-41.44~20.04.1
5.15.0-41.44~20.04.1
ubuntu/linux-ibm<5.4.0-1026.29
5.4.0-1026.29
ubuntu/linux-intel-iotg-5.15<5.15.0-1008.11~20.04.1
5.15.0-1008.11~20.04.1
ubuntu/linux-iot<5.4.0-1004.6
5.4.0-1004.6
ubuntu/linux-kvm<5.4.0-1068.72
5.4.0-1068.72
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-42.45~20.04.1
5.15.0-42.45~20.04.1
ubuntu/linux-oracle<5.4.0-1076.83
5.4.0-1076.83
ubuntu/linux-raspi<5.4.0-1065.75
5.4.0-1065.75
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1078.84+fips1
5.4.0-1078.84+fips1
ubuntu/linux-azure-fips<5.4.0-1083.87+fips1
5.4.0-1083.87+fips1
ubuntu/linux-fips<5.4.0-1054.61
5.4.0-1054.61
ubuntu/linux-gcp-fips<5.4.0-1078.84+fips1
5.4.0-1078.84+fips1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.15.0-37.39
5.15.0-37.39
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1011.14
5.15.0-1011.14
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-azure<5.15.0-1010.12
5.15.0-1010.12
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1008.12
5.15.0-1008.12
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gke<5.15.0-1008.10
5.15.0-1008.10
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm<5.15.0-1007.8
5.15.0-1007.8
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1008.11
5.15.0-1008.11
ubuntu/linux-kvm<5.15.0-1010.11
5.15.0-1010.11
ubuntu/linux-lowlatency<5.15.0-37.39
5.15.0-37.39
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1009.12
5.15.0-1009.12
ubuntu/linux-oracle-6.5*
ubuntu/linux-raspi<5.15.0-1011.13
5.15.0-1011.13
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-realtime<5.15.0-1014.14
5.15.0-1014.14
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1146.161~14.04.1
  2. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1150.156
  3. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-276.310~14.04.1
  4. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-276.310
  5. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1188.203
  6. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1137.148~16.04.1
  7. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1146.161~16.04.1
  8. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1131.147~16.04.1
  9. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-189.200~16.04.1
  10. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1151.162
  11. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1102.113~16.04.1
  12. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1120.127
  13. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-189.200
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1137.148
  15. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84~18.04.1
  16. Upgrade

    Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1146.161
  17. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1083.87~18.04.1
  18. Upgrade

    Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1131.147
  19. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84~18.04.1
  20. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-117.132~18.04.1
  21. Upgrade

    Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1028.32~18.04.1
  22. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1123.128
  23. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1102.113
  24. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1076.83~18.04.1
  25. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1065.75~18.04.1
  26. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2076.81
  27. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2057.63
  28. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1094.105
  29. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2041.46
  30. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-117.132
  31. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84
  32. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1083.87
  33. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.9~20.04.1
  34. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1040.44
  35. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84
  36. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-41.44~20.04.1
  37. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1026.29
  38. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.11~20.04.1
  39. Upgrade

    Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.

    Fixed in 5.4.0-1004.6
  40. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1068.72
  41. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-42.45~20.04.1
  42. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1076.83
  43. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1065.75
  44. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84+fips1
  45. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1083.87+fips1
  46. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1054.61
  47. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84+fips1
  48. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-37.39
  49. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1011.14
  50. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1010.12
  51. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.12
  52. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.10
  53. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1007.8
  54. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.11
  55. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1010.11
  56. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-37.39
  57. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1009.12
  58. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1011.13
  59. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1014.14

Event History

Feb 26, 2025
CVE Published
via MITRE·01:54 AM
Data Sourced
via MITRE·01:54 AM
Description
Data Sourced
via OSV·06:37 AM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2021-47634?

CVE-2021-47634 has a medium severity rating due to the potential for a use-after-free condition in the Linux kernel.

2

How do I fix CVE-2021-47634?

To fix CVE-2021-47634, you should update your Linux kernel to the latest version available that resolves this vulnerability.

3

Which versions are affected by CVE-2021-47634?

CVE-2021-47634 affects multiple versions of the Linux kernel, specifically from 3.2.84 up to but not including 5.17.2.

4

Is CVE-2021-47634 a remote attack vector?

CVE-2021-47634 can potentially be exploited locally, meaning an attacker would need local access to the affected system.

5

What systems are impacted by CVE-2021-47634?

Systems running affected versions of the Linux kernel are vulnerable to CVE-2021-47634, including various distributions of Linux.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203