CVE-2021-47118

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

pid: take a reference when initializing `cad_pid`

During boot, kernel_init_freeable() initializes `cad_pid` to the init

task's struct pid. Later on, we may change `cad_pid` via a sysctl, and

when this happens proc_do_cad_pid() will increment the refcount on the

new pid via get_pid(), and will decrement the refcount on the old pid

via put_pid(). As we never called get_pid() when we initialized

`cad_pid`, we decrement a reference we never incremented, can therefore

free the init task's struct pid early. As there can be dangling

references to the struct pid, we can later encounter a use-after-free

(e.g. when delivering signals).

This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to

have been around since the conversion of `cad_pid` to struct pid in

commit 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid") from the

pre-KASAN stone age of v2.6.19.

Fix this by getting a reference to the init task

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References