CVE-2021-46988

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: release page in error path to avoid BUG_ON

Consider the following sequence of events:

1. Userspace issues a UFFD ioctl, which ends up calling into

shmem_mfill_atomic_pte(). We successfully account the blocks, we

shmem_alloc_page(), but then the copy_from_user() fails. We return

-ENOENT. We don't release the page we allocated.

2. Our caller detects this error code, tries the copy_from_user() after

dropping the mmap_lock, and retries, calling back into

shmem_mfill_atomic_pte().

3. Meanwhile, let's say another process filled up the tmpfs being used.

4. So shmem_mfill_atomic_pte() fails to account blocks this time, and

immediately returns - without releasing the page.

This triggers a BUG_ON in our caller, which asserts that the page

should always be consumed, unless -ENOENT is returned.

To fix this, detect if we have such a "dangling" page when accounting

fails, and if so, release it bef

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References