UBUNTU-CVE-2021-47379: Use After Free

Published May 21, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd KASAN reports a use-after-free report when doing fuzz test: [693354.104835] ================================================================== [693354.105094] BUG: KASAN: use-after-free in bfqiosetweightlegacy+0xd3/0x160 [693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338 [693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147 [693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018 [693354.105612] Call Trace: [693354.105621] dumpstack+0xf1/0x19b [693354.105626] ? showregsprintinfo+0x5/0x5 [693354.105634] ? printk+0x9c/0xc3 [693354.105638] ? cpumaskweight+0x1f/0x1f [693354.105648] printaddressdescription+0x70/0x360 [693354.105654] kasanreport+0x1b2/0x330 [693354.105659] ? bfqiosetweightlegacy+0xd3/0x160 [693354.105665] ? bfqiosetweightlegacy+0xd3/0x160 [693354.105670] bfqiosetweightlegacy+0xd3/0x160 [693354.105675] ? bfqcpdinit+0x20/0x20 [693354.105683] cgroupfilewrite+0x3aa/0x510 [693354.105693] ? slaballoc+0x507/0x540 [693354.105698] ? cgroupfilepoll+0x60/0x60 [693354.105702] ? 0xffffffff89600000 [693354.105708] ? usercopyabort+0x90/0x90 [693354.105716] ? mutexlock+0xef/0x180 [693354.105726] kernfsfopwrite+0x1ab/0x280 [693354.105732] ? cgroupfilepoll+0x60/0x60 [693354.105738] vfswrite+0xe7/0x230 [693354.105744] ksyswrite+0xb0/0x140 [693354.105749] ? ia32sysread+0x50/0x50 [693354.105760] dosyscall64+0x112/0x370 [693354.105766] ? syscallreturnslowpath+0x260/0x260 [693354.105772] ? dopagefault+0x9b/0x270 [693354.105779] ? prepareexittousermode+0xf9/0x1a0 [693354.105784] ? enterfromusermode+0x30/0x30 [693354.105793] entrySYSCALL64afterhwframe+0x65/0xca [693354.105875] Allocated by task 1453337: [693354.106001] kasankmalloc+0xa0/0xd0 [693354.106006] kmemcacheallocnodetrace+0x108/0x220 [693354.106010] bfqpdalloc+0x96/0x120 [693354.106015] blkcgactivatepolicy+0x1b7/0x2b0 [693354.106020] bfqcreategrouphierarchy+0x1e/0x80 [693354.106026] bfqinitqueue+0x678/0x8c0 [693354.106031] blkmqinitsched+0x1f8/0x460 [693354.106037] elevatorswitchmq+0xe1/0x240 [693354.106041] elevatorswitch+0x25/0x40 [693354.106045] elvioschedstore+0x1a1/0x230 [693354.106049] queueattrstore+0x78/0xb0 [693354.106053] kernfsfopwrite+0x1ab/0x280 [693354.106056] vfswrite+0xe7/0x230 [693354.106060] ksyswrite+0xb0/0x140 [693354.106064] dosyscall64+0x112/0x370 [693354.106069] entrySYSCALL64afterhwframe+0x65/0xca [693354.106114] Freed by task 1453336: [693354.106225] kasanslabfree+0x130/0x180 [693354.106229] kfree+0x90/0x1b0 [693354.106233] blkcgdeactivatepolicy+0x12c/0x220 [693354.106238] bfqexitqueue+0xf5/0x110 [693354.106241] blkmqexitsched+0x104/0x130 [693354.106245] elevatorexit+0x45/0x60 [693354.106249] elevatorswitchmq+0xd6/0x240 [693354.106253] elevatorswitch+0x25/0x40 [693354.106257] elvioschedstore+0x1a1/0x230 [693354.106261] queueattrstore+0x78/0xb0 [693354.106264] kernfsfopwrite+0x1ab/0x280 [693354.106268] vfswrite+0xe7/0x230 [693354.106271] ksyswrite+0xb0/0x140 [693354.106275] dosyscall64+0x112/0x370 [693354.106280] entrySYSCALL64afterhwframe+0x65/0xca [693354.106329] The buggy address belongs to the object at ffff888be0a35580 which belongs to the cache kmalloc-1k of size 1024 [693354.106736] The buggy address is located 228 bytes inside of 1024-byte region [ffff888be0a35580, ffff888be0a35980) [693354.107114] The buggy address belongs to the page: [693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compoundmapcount: 0 [693354.107606] flags: 0x17ffffc0008100(slab|head) [693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080 [693354.108020] r ---truncated---

Affected Software

111 affected componentsFixes available
ubuntu/linux-azure<4.15.0-1190.205~14.04.1
4.15.0-1190.205~14.04.1
ubuntu/linux-aws-hwe<4.15.0-1182.195~16.04.1
4.15.0-1182.195~16.04.1
ubuntu/linux-azure<4.15.0-1190.205~16.04.1
4.15.0-1190.205~16.04.1
ubuntu/linux-gcp<4.15.0-1175.192~16.04.1
4.15.0-1175.192~16.04.1
ubuntu/linux-hwe<4.15.0-239.251~16.04.1
4.15.0-239.251~16.04.1
ubuntu/linux-oracle<4.15.0-1144.155~16.04.1
4.15.0-1144.155~16.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.4<5.4.0-1060.63~18.04.1
5.4.0-1060.63~18.04.1
ubuntu/linux-azure-5.4<5.4.0-1064.67~18.04.1
5.4.0-1064.67~18.04.1
ubuntu/linux-gcp-5.4<5.4.0-1058.62~18.04.1
5.4.0-1058.62~18.04.1
ubuntu/linux-hwe-5.4<5.4.0-91.102~18.04.1
5.4.0-91.102~18.04.1
ubuntu/linux-oracle-5.4<5.4.0-1058.62~18.04.1
5.4.0-1058.62~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1047.52~18.04.1
5.4.0-1047.52~18.04.1
ubuntu/linux<4.15.0-239.251
4.15.0-239.251
ubuntu/linux-aws<4.15.0-1182.195
4.15.0-1182.195
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-4.15<4.15.0-1190.205
4.15.0-1190.205
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-4.15<4.15.0-1175.192
4.15.0-1175.192
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-kvm<4.15.0-1165.170
4.15.0-1165.170
ubuntu/linux-oem*
ubuntu/linux-oracle<4.15.0-1144.155
4.15.0-1144.155
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-fips<4.15.0-2120.126
4.15.0-2120.126
ubuntu/linux-azure-fips<4.15.0-2099.105
4.15.0-2099.105
ubuntu/linux-fips<4.15.0-1137.148
4.15.0-1137.148
ubuntu/linux-gcp-fips<4.15.0-2083.89
4.15.0-2083.89
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-91.102
5.4.0-91.102
ubuntu/linux-aws<5.4.0-1060.63
5.4.0-1060.63
ubuntu/linux-azure<5.4.0-1064.67
5.4.0-1064.67
ubuntu/linux-bluefield<5.4.0-1022.25
5.4.0-1022.25
ubuntu/linux-gcp<5.4.0-1058.62
5.4.0-1058.62
ubuntu/linux-gkeop<5.4.0-1027.28
5.4.0-1027.28
ubuntu/linux-ibm<5.4.0-1008.9
5.4.0-1008.9
ubuntu/linux-kvm<5.4.0-1050.52
5.4.0-1050.52
ubuntu/linux-oracle<5.4.0-1058.62
5.4.0-1058.62
ubuntu/linux-raspi<5.4.0-1047.52
5.4.0-1047.52
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1069.73+fips2
5.4.0-1069.73+fips2
ubuntu/linux-azure-fips<5.4.0-1073.76+fips1
5.4.0-1073.76+fips1
ubuntu/linux-fips<5.4.0-1037.43
5.4.0-1037.43
ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1
5.4.0-1067.71~20.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1190.205~14.04.1
  2. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1182.195~16.04.1
  3. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1190.205~16.04.1
  4. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1175.192~16.04.1
  5. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-239.251~16.04.1
  6. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1144.155~16.04.1
  7. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1060.63~18.04.1
  8. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1064.67~18.04.1
  9. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1058.62~18.04.1
  10. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-91.102~18.04.1
  11. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1058.62~18.04.1
  12. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1047.52~18.04.1
  13. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-239.251
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1182.195
  15. Upgrade

    Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1190.205
  16. Upgrade

    Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1175.192
  17. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1165.170
  18. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1144.155
  19. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2120.126
  20. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2099.105
  21. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1137.148
  22. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2083.89
  23. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-91.102
  24. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1060.63
  25. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1064.67
  26. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1022.25
  27. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1058.62
  28. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.4.0-1027.28
  29. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1008.9
  30. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1050.52
  31. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1058.62
  32. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1047.52
  33. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1069.73+fips2
  34. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1073.76+fips1
  35. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1037.43
  36. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1067.71~20.04.1

Event History

May 21, 2024
CVE Published
via OSV·03:15 PM
Data Sourced
via OSV·03:15 PM
DescriptionSeverityAffected Software

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203