CVE-2021-46984

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kyber: fix out of bounds access when preempted

__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and

passes the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx

for the current CPU again and uses that to get the corresponding Kyber

context in the passed hctx. However, the thread may be preempted between

the two calls to blk_mq_get_ctx(), and the ctx returned the second time

may no longer correspond to the passed hctx. This "works" accidentally

most of the time, but it can cause us to read garbage if the second ctx

came from an hctx with more ctx's than the first one (i.e., if

ctx->index_hw[hctx->type] > hctx->nr_ctx).

This manifested as this UBSAN array index out of bounds error reported

by Jakub:

UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9

index 13106 is out of range for type 'long unsigned int [128]'

Call Trace:

dump_stack+0xa4/0xe5

ubsan_epilogue+0x5/0x4

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References