|
Vulnerabilities
< Back

CVE-2021-47506

Updated on 24 May 2024

Severity

7.8 High severity

Details

CVSS score
7.8
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix use-after-free due to delegation race

A delegation break could arrive as soon as we’ve called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru.

Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread.

I suspect aba2072f4523 “nfsd: grant read delegations to clients holding writes” made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I’m not sure where the bug was introduced; it may have been there from the beginning.

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 6 ELS , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 6 ELS , CloudLinux 7 ELS , Debian 10 ELS , Oracle Linux 6 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS
Affected packages:
kernel @ 3.10.0 (+17 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Amazon Linux 1 Will Not Fix —
Amazon Linux 2 Planned —
Amazon Linux 2 5.10 Will Not Fix —
Amazon Linux 2 5.4 Will Not Fix —
CentOS 7 ELS Released
32 kernels
  • 3.10.0-1160.119.1.el7.tuxcare.els10
  • 3.10.0-1160.119.1.el7.tuxcare.els4
  • 3.10.0-1160.119.1.el7.tuxcare.els6
  • 3.10.0-1160.119.1.el7.tuxcare.els15
  • 3.10.0-1160.119.1.el7.tuxcare.els5
  • 3.10.0-1160.119.1.el7.tuxcare.els3
  • 3.10.0-1160.119.1.el7.tuxcare.els14
  • 3.10.0-1160.119.1.el7.tuxcare.els16
  • 3.10.0-1160.119.1.el7.tuxcare.els13
  • 3.10.0-1160.119.1.el7.tuxcare.els7
  • 3.10.0-1160.119.1.el7.tuxcare.els12
  • 3.10.0-1160.119.1.el7.tuxcare.els9
  • 3.10.0-1160.119.1.el7.tuxcare.els8
  • 3.10.0-1160.119.1.el7.tuxcare.els17
  • 3.10.0-1160.119.1.el7.tuxcare.els18
  • 3.10.0-1160.119.1.el7.tuxcare.els19
  • 3.10.0-1160.119.1.el7.tuxcare.els20
  • 3.10.0-1160.119.1.el7.tuxcare.els21
  • 3.10.0-1160.119.1.el7.tuxcare.els24
  • 3.10.0-1160.119.1.el7.tuxcare.els22
  • 3.10.0-1160.119.1.el7.tuxcare.els25
  • 3.10.0-1160.139.1.el7.tuxcare.els2
  • 3.10.0-1160.139.1.el7.tuxcare.els3
  • 3.10.0-1160.139.1.el7.tuxcare.els4
  • 3.10.0-1160.142.1.el7.tuxcare.els1
  • 3.10.0-1160.144.1.el7.tuxcare.els1
  • 3.10.0-1160.144.1.el7.tuxcare.els2
  • 3.10.0-1160.144.1.el7.tuxcare.els3
  • 3.10.0-1160.144.1.el7.tuxcare.els4
  • 3.10.0-1160.144.1.el7.tuxcare.els5
  • 3.10.0-1160.144.1.el7.tuxcare.els6
  • 3.10.0-1160.144.1.el7.tuxcare.els7
Debian 10 Will Not Fix —
Debian 10 cloud Will Not Fix —
Debian 11 Planned —
Ubuntu 16.04 AWS ESM Will Not Fix —
Ubuntu 16.04 AWS HWE ESM Will Not Fix —
Ubuntu 16.04 Azure ESM Will Not Fix —
Ubuntu 16.04 ESM Will Not Fix —
Ubuntu 16.04 GCP ESM Will Not Fix —
Ubuntu 16.04 HWE ESM Will Not Fix —
Ubuntu 18.04 Will Not Fix —
Ubuntu 18.04 AWS Will Not Fix —
Ubuntu 18.04 AWS Focal Will Not Fix —
Ubuntu 18.04 Azure Focal Will Not Fix —
Ubuntu 18.04 HWE Focal Will Not Fix —
Ubuntu 20.04 Will Not Fix —
Ubuntu 20.04 AWS Will Not Fix —