CVE-2021-47044

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/fair: Fix shift-out-of-bounds in load_balance()

Syzbot reported a handful of occurrences where an sd->nr_balance_failed can

grow to much higher values than one would expect.

A successful load_balance() resets it to 0; a failed one increments

it. Once it gets to sd->cache_nice_tries + 3, this *should* trigger an

active balance, which will either set it to sd->cache_nice_tries+1 or reset

it to 0. However, in case the to-be-active-balanced task is not allowed to

run on env->dst_cpu, then the increment is done without any further

modification.

This could then be repeated ad nauseam, and would explain the absurdly high

values reported by syzbot (86, 149). VincentG noted there is value in

letting sd->cache_nice_tries grow, so the shift itself should be

fixed. That means preventing:

"""

If the value of the right operand is negative or is greater than or equal

to the width of the promoted left operand, the beh

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References