CVE-2021-47163

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47163
In the Linux kernel, the following vulnerability has been resolved: tipc: wait and exit until all work queues are done On some host, a crash could be triggered simply by repeating these commands several times: # modprobe tipc # tipc bearer enable media udp name UDP1 localip 127.0.0.1 # rmmod tipc [] BUG: unable to handle kernel paging request at ffffffffc096bb00 [] Workqueue: events 0xffffffffc096bb00 [] Call Trace: [] ? process_one_work+0x1a7/0x360 [] ? worker_thread+0x30/0x390 [] ? create_worker+0x1a0/0x1a0 [] ? kthread+0x116/0x130 [] ? kthread_flush_work_fn+0x10/0x10 [] ? ret_from_fork+0x35/0x40 When removing the TIPC module, the UDP tunnel sock will be delayed to release in a work queue as sock_release() can't be done in rtnl_lock(). If the work queue is schedule to run after the TIPC module is removed, kernel will crash as the work queue function cleanup_beareri() code no longer exists when trying to invoke it. To fix it, this patch introduce a member wq_count in tipc_net to track the numbers of work queues in schedule, and wait and exit until all work queues are done in tipc_exit_net().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/04c26faa51d1e2fe71cf13c45791f5174c37f986 Patch
https://git.kernel.org/stable/c/5195ec5e365a2a9331bfeb585b613a6e94f98dba Patch
https://git.kernel.org/stable/c/b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d Patch
https://git.kernel.org/stable/c/d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa Patch
https://git.kernel.org/stable/c/04c26faa51d1e2fe71cf13c45791f5174c37f986 Patch
https://git.kernel.org/stable/c/5195ec5e365a2a9331bfeb585b613a6e94f98dba Patch
https://git.kernel.org/stable/c/b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d Patch
https://git.kernel.org/stable/c/d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
History

13 Mar 2025, 21:23

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-667
References () https://git.kernel.org/stable/c/04c26faa51d1e2fe71cf13c45791f5174c37f986 - () https://git.kernel.org/stable/c/04c26faa51d1e2fe71cf13c45791f5174c37f986 - Patch
References () https://git.kernel.org/stable/c/5195ec5e365a2a9331bfeb585b613a6e94f98dba - () https://git.kernel.org/stable/c/5195ec5e365a2a9331bfeb585b613a6e94f98dba - Patch
References () https://git.kernel.org/stable/c/b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d - () https://git.kernel.org/stable/c/b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d - Patch
References () https://git.kernel.org/stable/c/d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa - () https://git.kernel.org/stable/c/d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa - Patch

21 Nov 2024, 06:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/04c26faa51d1e2fe71cf13c45791f5174c37f986 - () https://git.kernel.org/stable/c/04c26faa51d1e2fe71cf13c45791f5174c37f986 -
References () https://git.kernel.org/stable/c/5195ec5e365a2a9331bfeb585b613a6e94f98dba - () https://git.kernel.org/stable/c/5195ec5e365a2a9331bfeb585b613a6e94f98dba -
References () https://git.kernel.org/stable/c/b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d - () https://git.kernel.org/stable/c/b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d -
References () https://git.kernel.org/stable/c/d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa - () https://git.kernel.org/stable/c/d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa -

25 Mar 2024, 13:47

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tipc: espere y salga hasta que todas las colas de trabajo estén terminadas. En algunos hosts, se podría desencadenar un bloqueo simplemente repitiendo estos comandos varias veces: # modprobe tipc # tipc portador habilitar media udp nombre UDP1 localip 127.0.0.1 # rmmod tipc [] ERROR: no se puede manejar la solicitud de paginación del kernel en ffffffffc096bb00 [] Cola de trabajo: eventos 0xffffffffc096bb00 [] Seguimiento de llamadas: []? proceso_one_work+0x1a7/0x360 []? hilo_trabajador+0x30/0x390 []? crear_trabajador+0x1a0/0x1a0 []? kthread+0x116/0x130 []? kthread_flush_work_fn+0x10/0x10 []? ret_from_fork+0x35/0x40 Al retirar el módulo TIPC, el calcetín del túnel UDP se retrasará para liberarse en una cola de trabajo, ya que sock_release() no se puede realizar en rtnl_lock(). Si la cola de trabajo está programada para ejecutarse después de eliminar el módulo TIPC, el kernel fallará porque el código de la función de cola de trabajo cleanup_beareri() ya no existe al intentar invocarlo. Para solucionarlo, este parche introduce un miembro wq_count en tipc_net para rastrear el número de colas de trabajo programadas y esperar y salir hasta que todas las colas de trabajo estén terminadas en tipc_exit_net().

25 Mar 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-25 10:15

Updated : 2025-03-13 21:23

NVD link : CVE-2021-47163

Mitre link : CVE-2021-47163

CVE.ORG link : CVE-2021-47163

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking