CVE-2021-47125

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47125
In the Linux kernel, the following vulnerability has been resolved: sch_htb: fix refcount leak in htb_parent_to_leaf_offload The commit ae81feb7338c ("sch_htb: fix null pointer dereference on a null new_q") fixes a NULL pointer dereference bug, but it is not correct. Because htb_graft_helper properly handles the case when new_q is NULL, and after the previous patch by skipping this call which creates an inconsistency : dev_queue->qdisc will still point to the old qdisc, but cl->parent->leaf.q will point to the new one (which will be noop_qdisc, because new_q was NULL). The code is based on an assumption that these two pointers are the same, so it can lead to refcount leaks. The correct fix is to add a NULL pointer check to protect qdisc_refcount_inc inside htb_parent_to_leaf_offload.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2411c02d03892a5057499f8102d0cc1e0f852416 Patch
https://git.kernel.org/stable/c/944d671d5faa0d78980a3da5c0f04960ef1ad893 Patch
https://git.kernel.org/stable/c/2411c02d03892a5057499f8102d0cc1e0f852416 Patch
https://git.kernel.org/stable/c/944d671d5faa0d78980a3da5c0f04960ef1ad893 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
History

07 Jan 2025, 18:00

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/2411c02d03892a5057499f8102d0cc1e0f852416 - () https://git.kernel.org/stable/c/2411c02d03892a5057499f8102d0cc1e0f852416 - Patch
References () https://git.kernel.org/stable/c/944d671d5faa0d78980a3da5c0f04960ef1ad893 - () https://git.kernel.org/stable/c/944d671d5faa0d78980a3da5c0f04960ef1ad893 - Patch
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-Other

21 Nov 2024, 06:35

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sch_htb: corrige la fuga de recuento en htb_parent_to_leaf_offload el commit ae81feb7338c ("sch_htb: corrige la desreferencia del puntero nulo en un new_q nulo") corrige un error de desreferencia del puntero NULL, pero no es correcto. Debido a que htb_graft_helper maneja adecuadamente el caso cuando new_q es NULL, y después del parche anterior al omitir esta llamada, se crea una inconsistencia: dev_queue->qdisc seguirá apuntando a la qdisc anterior, pero cl->parent->leaf.q apuntará a el nuevo (que será noop_qdisc, porque new_q era NULL). El código se basa en la suposición de que estos dos indicadores son iguales, por lo que puede provocar fugas de recuento. La solución correcta es agregar una verificación de puntero NULL para proteger qdisc_refcount_inc dentro de htb_parent_to_leaf_offload.
References () https://git.kernel.org/stable/c/2411c02d03892a5057499f8102d0cc1e0f852416 - () https://git.kernel.org/stable/c/2411c02d03892a5057499f8102d0cc1e0f852416 -
References () https://git.kernel.org/stable/c/944d671d5faa0d78980a3da5c0f04960ef1ad893 - () https://git.kernel.org/stable/c/944d671d5faa0d78980a3da5c0f04960ef1ad893 -

15 Mar 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-15 21:15

Updated : 2025-01-07 18:00

NVD link : CVE-2021-47125

Mitre link : CVE-2021-47125

CVE.ORG link : CVE-2021-47125

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-Other