CVE-2021-47069

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry

do_mq_timedreceive calls wq_sleep with a stack local address. The

sender (do_mq_timedsend) uses this address to later call pipelined_send.

This leads to a very hard to trigger race where a do_mq_timedreceive

call might return and leave do_mq_timedsend to rely on an invalid

address, causing the following crash:

RIP: 0010:wake_q_add_safe+0x13/0x60

Call Trace:

__x64_sys_mq_timedsend+0x2a9/0x490

do_syscall_64+0x80/0x680

entry_SYSCALL_64_after_hwframe+0x44/0xa9

RIP: 0033:0x7f5928e40343

The race occurs as:

1. do_mq_timedreceive calls wq_sleep with the address of `struct

ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it

holds a valid `struct ext_wait_queue *` as long as the stack has not

been overwritten.

2. `ewq_addr` gets added to info->e_wait_q[RECV].list in wq_add, and

do_mq_timedsend receives it v

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References