CVE-2021-47011

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: memcontrol: slab: fix obtain a reference to a freeing memcg

Patch series "Use obj_cgroup APIs to charge kmem pages", v5.

Since Roman's series "The new cgroup slab memory controller" applied.

All slab objects are charged with the new APIs of obj_cgroup. The new

APIs introduce a struct obj_cgroup to charge slab objects. It prevents

long-living objects from pinning the original memory cgroup in the

memory. But there are still some corner objects (e.g. allocations

larger than order-1 page on SLUB) which are not charged with the new

APIs. Those objects (include the pages which are allocated from buddy

allocator directly) are charged as kmem pages which still hold a

reference to the memory cgroup.

E.g. We know that the kernel stack is charged as kmem pages because the

size of the kernel stack can be greater than 2 pages (e.g. 16KB on

x86_64 or arm64). If we create a thread (suppose the thread stack is

charged

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References