UBUNTU-CVE-2021-47589: Use After Free

Published Jun 19, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in igbvfprobe In igbvfprobe, if registernetdev() fails, the program will go to label errhwinit, and then to label errioremap. In freenetdev() which is just below label errioremap, there is listforeachentrysafe and netifnapidel which aims to delete all entries in dev->napilist. The program has added an entry adapter->rxring->napi which is added by netifnapiadd in igbvfallocqueues(). However, adapter->rxring has been freed below label errhwinit. So this a UAF. In terms of how to patch the problem, we can refer to igbvfremove() and delete the entry before adapter->rxring. The KASAN logs are as follows: [ 35.126075] BUG: KASAN: use-after-free in freenetdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dumpstacklvl+0x59/0x7b [ 35.132865] printaddressdescription+0x7c/0x3b0 [ 35.133707] ? freenetdev+0x1fd/0x450 [ 35.134378] kasanreport+0x160/0x1c0 [ 35.135063] ? freenetdev+0x1fd/0x450 [ 35.135738] kasanreport+0x4b/0x70 [ 35.136367] freenetdev+0x1fd/0x450 [ 35.137006] igbvfprobe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvfvlanrxaddvid+0x100/0x100 [igbvf] [ 35.138751] localpciprobe+0x13c/0x1f0 [ 35.139461] pcideviceprobe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] kasankmalloc+0xc4/0xf0 [ 35.167117] fookmemcachealloctrace+0x3c/0x50 [igbvf] [ 35.168078] igbvfprobe+0x9c5/0x1a10 [igbvf] [ 35.168866] localpciprobe+0x13c/0x1f0 [ 35.169565] pcideviceprobe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasansettrack+0x4c/0x80 [ 35.181211] kasansetfreeinfo+0x1f/0x40 [ 35.181942] kasanslabfree+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvfprobe+0x1173/0x1a10 [igbvf] [ 35.184040] localpciprobe+0x13c/0x1f0

Affected Software

120 affected componentsFixes available

ubuntu/linux-azure<4.15.0-1131.144~14.04.1

4.15.0-1131.144~14.04.1

ubuntu/linux*

ubuntu/linux-aws<4.4.0-1148.154

4.4.0-1148.154

ubuntu/linux-lts-xenial<4.4.0-273.307~14.04.1

4.4.0-273.307~14.04.1

ubuntu/linux<4.4.0-273.307

4.4.0-273.307

ubuntu/linux-aws<4.4.0-1186.201

4.4.0-1186.201

ubuntu/linux-aws-hwe<4.15.0-1120.128~16.04.1

4.15.0-1120.128~16.04.1

ubuntu/linux-azure<4.15.0-1131.144~16.04.1

4.15.0-1131.144~16.04.1

ubuntu/linux-gcp<4.15.0-1116.130~16.04.1

4.15.0-1116.130~16.04.1

ubuntu/linux-hwe<4.15.0-169.177~16.04.1

4.15.0-169.177~16.04.1

ubuntu/linux-kvm<4.4.0-1149.160

4.4.0-1149.160

ubuntu/linux-oracle<4.15.0-1087.95~16.04.1

4.15.0-1087.95~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-fips<4.4.0-1119.126

4.4.0-1119.126

ubuntu/linux-fips*

ubuntu/linux<4.15.0-169.177

4.15.0-169.177

ubuntu/linux-aws<4.15.0-1121.129

4.15.0-1121.129

ubuntu/linux-aws-5.4<5.4.0-1069.73~18.04.1

5.4.0-1069.73~18.04.1

ubuntu/linux-azure-4.15<4.15.0-1131.144

4.15.0-1131.144

ubuntu/linux-azure-5.4<5.4.0-1073.76~18.04.1

5.4.0-1073.76~18.04.1

ubuntu/linux-gcp-4.15<4.15.0-1116.130

4.15.0-1116.130

ubuntu/linux-gcp-5.4<5.4.0-1068.72~18.04.1

5.4.0-1068.72~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-105.119~18.04.1

5.4.0-105.119~18.04.1

ubuntu/linux-ibm-5.4<5.4.0-1018.20~18.04.1

5.4.0-1018.20~18.04.1

ubuntu/linux-kvm<4.15.0-1107.109

4.15.0-1107.109

ubuntu/linux-oracle<4.15.0-1087.95

4.15.0-1087.95

ubuntu/linux-oracle-5.4<5.4.0-1067.72~18.04.1

5.4.0-1067.72~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1056.63~18.04.1

5.4.0-1056.63~18.04.1

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2061.63

4.15.0-2061.63

ubuntu/linux-azure-fips<4.15.0-2043.47

4.15.0-2043.47

ubuntu/linux-fips<4.15.0-1078.87

4.15.0-1078.87

ubuntu/linux-gcp-fips<4.15.0-2026.28

4.15.0-2026.28

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-105.119

5.4.0-105.119

ubuntu/linux-aws<5.4.0-1069.73

5.4.0-1069.73

ubuntu/linux-azure<5.4.0-1073.76

5.4.0-1073.76

ubuntu/linux-bluefield<5.4.0-1032.35

5.4.0-1032.35

ubuntu/linux-gcp<5.4.0-1068.72

5.4.0-1068.72

ubuntu/linux-gkeop<5.4.0-1037.38

5.4.0-1037.38

ubuntu/linux-ibm<5.4.0-1018.20

5.4.0-1018.20

ubuntu/linux-kvm<5.4.0-1059.62

5.4.0-1059.62

ubuntu/linux-oracle<5.4.0-1067.72

5.4.0-1067.72

ubuntu/linux-raspi<5.4.0-1056.63

5.4.0-1056.63

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1069.73+fips2

5.4.0-1069.73+fips2

ubuntu/linux-azure-fips<5.4.0-1073.76+fips1

5.4.0-1073.76+fips1

ubuntu/linux-fips<5.4.0-1046.52

5.4.0-1046.52

ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1

5.4.0-1067.71~20.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1131.144~14.04.1
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1148.154
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-273.307~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-273.307
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1186.201
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1120.128~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1131.144~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1116.130~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-169.177~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1149.160
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1087.95~16.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1119.126
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-169.177
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1121.129
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1131.144
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1116.130
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1068.72~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-105.119~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1018.20~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1107.109
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1087.95
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.72~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.63~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2061.63
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2043.47
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1078.87
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2026.28
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-105.119
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1032.35
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1068.72
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1037.38
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1018.20
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1059.62
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.72
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.63
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73+fips2
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1046.52
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.71~20.04.1
Compensating control
In igbvf_probe() error handling, delete the adapter->rx_ring->napi entry before freeing adapter->rx_ring, following the cleanup ordering used by igbvf_remove(), so free_netdev() does not process the freed NAPI entry.

Event History

Jun 19, 2024

CVE Published

via OSV·03:15 PM

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The issue applies to the listed Ubuntu Linux kernel packages when the igbvf driver is being probed. The affected package families include linux, linux-aws, linux-azure, linux-gcp, and their listed FIPS variants.

What conditions are needed to trigger the fault?

The fault occurs when igbvf_probe reaches a register_netdev() failure path after NAPI has been added for a receive ring. That path frees the receive ring before free_netdev() later accesses the NAPI list, resulting in a use-after-free and potential double-free condition.

What level of attacker access is indicated?

The supplied severity vector indicates local access with low privileges and no user interaction. The provided data does not identify a specific method an attacker could use to force the failing probe path.

How can I identify evidence that the issue has occurred?

Kernel AddressSanitizer may report a use-after-free in free_netdev during igbvf probe or module loading, including a read from freed memory. The example trace shows the event under a modprobe task after register_netdev() failed.

UBUNTU-CVE-2021-47589: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions are needed to trigger the fault?

What level of attacker access is indicated?

How can I identify evidence that the issue has occurred?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions are needed to trigger the fault?

What level of attacker access is indicated?

How can I identify evidence that the issue has occurred?