CVE-2021-47545

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: usb: fix possible use-after-free in smsc75xx_bind

The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind") fails to clean up the work scheduled in smsc75xx_reset-> smsc75xx_set_multicast, which leads to use-after-free if the work is scheduled to start after the deallocation. In addition, this patch also removes a dangling pointer - dev->data[0].

This patch calls cancel_work_sync to cancel the scheduled work and set the dangling pointer to NULL.(CVE-2021-47239)

In the Linux kernel, the following vulnerability has been resolved:

RDMA: Verify port when creating flow rule

Validate port value provided by the user and with that remove no longer needed validation by the driver. The missing check in the mlx5_ib driver could cause to the below oops.

Call trace: _create_flow_rule+0x2d4/0xf28 [mlx5_ib] mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib] ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs] ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs] ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs] do_vfs_ioctl+0xd0/0xaf0 ksys_ioctl+0x84/0xb4 __arm64_sys_ioctl+0x28/0xc4 el0_svc_common.constprop.3+0xa4/0x254 el0_svc_handler+0x84/0xa0 el0_svc+0x10/0x26c Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)(CVE-2021-47265)

In the Linux kernel, the following vulnerability has been resolved:

bcache: avoid oversized read request in cache missing code path

In the cache missing code path of cached device, if a proper location from the internal B+ tree is matched for a cache miss range, function cached_dev_cache_miss() will be called in cache_lookup_fn() in the following code block, [code block 1] 526 unsigned int sectors = KEY_INODE(k) == s->iop.inode 527 ? min_t(uint64_t, INT_MAX, 528 KEY_START(k) - bio->bi_iter.bi_sector) 529 : INT_MAX; 530 int ret = s->d->cache_miss(b, s, bio, sectors);

Here s->d->cache_miss() is the call backfunction pointer initialized as cached_dev_cache_miss(), the last parameter 'sectors' is an important hint to calculate the size of read request to backing device of the missing cache data.

Current calculation in above code block may generate oversized value of 'sectors', which consequently may trigger 2 different potential kernel panics by BUG() or BUG_ON() as listed below,

1. BUG_ON() inside bch_btree_insert_key(), [code block 2] 886 BUG_ON(b->ops->is_extents && !KEY_SIZE(k));
2. BUG() inside biovec_slab(), [code block 3] 51 default: 52 BUG(); 53 return NULL;

All the above panics are original from cached_dev_cache_miss() by the oversized parameter 'sectors'.

Inside cached_dev_cache_miss(), parameter 'sectors' is used to calculate the size of data read from backing device for the cache missing. This size is stored in s->insert_bio_sectors by the following lines of code, [code block 4] 909 s->insert_bio_sectors = min(sectors, bio_sectors(bio) + reada);

Then the actual key inserting to the internal B+ tree is generated and stored in s->iop.replace_key by the following lines of code, [code block 5] 911 s->iop.replace_key = KEY(s->iop.inode, 912 bio->bi_iter.bi_sector + s->insert_bio_sectors, 913 s->insert_bio_sectors); The oversized parameter 'sectors' may trigger panic 1) by BUG_ON() from the above code block.

And the bio sending to backing device for the missing data is allocated with hint from s->insert_bio_sectors by the following lines of code, [code block 6] 926 cache_bio = bio_alloc_bioset(GFP_NOWAIT, 927 …

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

• CVE-url: https://ubuntu.com/security/CVE-2024-2201
  • x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
  • x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file
  • x86/bhi: Add support for clearing branch history at syscall entry
  • x86/bhi: Define SPEC_CTRL_BHI_DIS_S
  • x86/bhi: Enumerate Branch History Injection (BHI) bug
  • x86/bhi: Add BHI mitigation knob
  • x86/bhi: Mitigate KVM by default
  • x86/bugs: Fix BHI documentation
  • x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES
  • x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr'
  • x86/bugs: Fix BHI handling of RRSBA
  • x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
  • x86/bugs: Fix BHI retpoline check
• CVE-url: https://ubuntu.com/security/CVE-2024-26642
  • netfilter: nf_tables: disallow anonymous set with timeout flag
• CVE-url: https://ubuntu.com/security/CVE-2021-33631
  • ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
• CVE-url: https://ubuntu.com/security/CVE-2021-47545
  • perf hists: Properly release format fields
  • perf hist: Fix memory leak of a perf_hpp_fmt
• Miscellaneous upstream changes
  • media: xc4000: Fix atomicity violation in xc4000_get_frequency
  • updateconfigs for CONFIG_BHI_{AUTO|OFF|ON}

• CVE-url: https://ubuntu.com/security/CVE-2024-2201
  • x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
  • x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file
  • x86/bhi: Add support for clearing branch history at syscall entry
  • x86/bhi: Define SPEC_CTRL_BHI_DIS_S
  • x86/bhi: Enumerate Branch History Injection (BHI) bug
  • x86/bhi: Add BHI mitigation knob
  • x86/bhi: Mitigate KVM by default
  • x86/bugs: Fix BHI documentation
  • x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES
  • x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr'
  • x86/bugs: Fix BHI handling of RRSBA
  • x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
  • x86/bugs: Fix BHI retpoline check
• CVE-url: https://ubuntu.com/security/CVE-2024-26642
  • netfilter: nf_tables: disallow anonymous set with timeout flag
• CVE-url: https://ubuntu.com/security/CVE-2021-33631
  • ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
• CVE-url: https://ubuntu.com/security/CVE-2021-47545
  • perf hists: Properly release format fields
  • perf hist: Fix memory leak of a perf_hpp_fmt
• Miscellaneous upstream changes
  • media: xc4000: Fix atomicity violation in xc4000_get_frequency
  • updateconfigs for CONFIG_BHI_{AUTO|OFF|ON}