CVE-2021-47603

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

audit: improve robustness of the audit queue handling

If the audit daemon were ever to get stuck in a stopped state the

kernel's kauditd_thread() could get blocked attempting to send audit

records to the userspace audit daemon. With the kernel thread

blocked it is possible that the audit queue could grow unbounded as

certain audit record generating events must be exempt from the queue

limits else the system enter a deadlock state.

This patch resolves this problem by lowering the kernel thread's

socket sending timeout from MAX_SCHEDULE_TIMEOUT to HZ/10 and tweaks

the kauditd_send_queue() function to better manage the various audit

queues when connection problems occur between the kernel and the

audit daemon. With this patch, the backlog may temporarily grow

beyond the defined limits when the audit daemon is stopped and the

system is under heavy audit pressure, but kauditd_thread() will

continue to make progress and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References