CVE-2021-47209

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/fair: Prevent dead task groups from regaining cfs_rq's

Kevin is reporting crashes which point to a use-after-free of a cfs_rq

in update_blocked_averages(). Initial debugging revealed that we've

live cfs_rq's (on_list=1) in an about to be kfree()'d task group in

free_fair_sched_group(). However, it was unclear how that can happen.

His kernel config happened to lead to a layout of struct sched_entity

that put the 'my_q' member directly into the middle of the object

which makes it incidentally overlap with SLUB's freelist pointer.

That, in combination with SLAB_FREELIST_HARDENED's freelist pointer

mangling, leads to a reliable access violation in form of a #GP which

made the UAF fail fast.

Michal seems to have run into the same issue[1]. He already correctly

diagnosed that commit a7b359fc6a37 ("sched/fair: Correctly insert

cfs_rq's to list on unthrottle") is causing the preconditions for the

UAF to happen by re-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References