CVE-2021-46921

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

locking/qrwlock: Fix ordering in queued_write_lock_slowpath()

While this code is executed with the wait_lock held, a reader can

acquire the lock without holding wait_lock. The writer side loops

checking the value with the atomic_cond_read_acquire(), but only truly

acquires the lock when the compare-and-exchange is completed

successfully which isn’t ordered. This exposes the window between the

acquire and the cmpxchg to an A-B-A problem which allows reads

following the lock acquisition to observe values speculatively before

the write lock is truly acquired.

We've seen a problem in epoll where the reader does a xchg while

holding the read lock, but the writer can see a value change out from

under it.

Writer | Reader

--------------------------------------------------------------------------------

ep_scan_ready_list() |

|- write_lock_irq() |

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References