CVE-2021-47448

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix possible stall on recvmsg()

recvmsg() can enter an infinite loop if the caller provides the

MSG_WAITALL, the data present in the receive queue is not sufficient to

fulfill the request, and no more data is received by the peer.

When the above happens, mptcp_wait_data() will always return with

no wait, as the MPTCP_DATA_READY flag checked by such function is

set and never cleared in such code path.

Leveraging the above syzbot was able to trigger an RCU stall:

rcu: INFO: rcu_preempt self-detected stall on CPU

rcu: 0-...!: (10499 ticks this GP) idle=0af/1/0x4000000000000000 softirq=10678/10678 fqs=1

(t=10500 jiffies g=13089 q=109)

rcu: rcu_preempt kthread starved for 10497 jiffies! g13089 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1

rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.

rcu: RCU grace-period kthread stack dump:

task:rcu_preempt state:R runn

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References