CVE-2021-47553

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/scs: Reset task stack state in bringup_cpu()

To hot unplug a CPU, the idle task on that CPU calls a few layers of C

code before finally leaving the kernel. When KASAN is in use, poisoned

shadow is left around for each of the active stack frames, and when

shadow call stacks are in use. When shadow call stacks (SCS) are in use

the task's saved SCS SP is left pointing at an arbitrary point within

the task's shadow call stack.

When a CPU is offlined than onlined back into the kernel, this stale

state can adversely affect execution. Stale KASAN shadow can alias new

stackframes and result in bogus KASAN warnings. A stale SCS SP is

effectively a memory leak, and prevents a portion of the shadow call

stack being used. Across a number of hotplug cycles the idle task's

entire shadow call stack can become unusable.

We previously fixed the KASAN issue in commit:

e1b77c92981a5222 ("sched/kasan: remove stale KASAN poiso

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References