CVE-2021-46921
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
27/02/2024
Last modified:
10/04/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()<br />
<br />
While this code is executed with the wait_lock held, a reader can<br />
acquire the lock without holding wait_lock. The writer side loops<br />
checking the value with the atomic_cond_read_acquire(), but only truly<br />
acquires the lock when the compare-and-exchange is completed<br />
successfully which isn’t ordered. This exposes the window between the<br />
acquire and the cmpxchg to an A-B-A problem which allows reads<br />
following the lock acquisition to observe values speculatively before<br />
the write lock is truly acquired.<br />
<br />
We&#39;ve seen a problem in epoll where the reader does a xchg while<br />
holding the read lock, but the writer can see a value change out from<br />
under it.<br />
<br />
Writer | Reader<br />
--------------------------------------------------------------------------------<br />
ep_scan_ready_list() |<br />
|- write_lock_irq() |<br />
|- queued_write_lock_slowpath() |<br />
|- atomic_cond_read_acquire() |<br />
| read_lock_irqsave(&ep->lock, flags);<br />
--> (observes value before unlock) | chain_epi_lockless()<br />
| | epi->next = xchg(&ep->ovflist, epi);<br />
| | read_unlock_irqrestore(&ep->lock, flags);<br />
| |<br />
| atomic_cmpxchg_relaxed() |<br />
|-- READ_ONCE(ep->ovflist); |<br />
<br />
A core can order the read of the ovflist ahead of the<br />
atomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire<br />
semantics addresses this issue at which point the atomic_cond_read can<br />
be switched to use relaxed semantics.<br />
<br />
[peterz: use try_cmpxchg()]
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.15.0 (including) | 4.19.189 (excluding) |
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.20.0 (including) | 5.4.115 (excluding) |
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.5.0 (including) | 5.10.33 (excluding) |
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.11.0 (including) | 5.11.17 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e
- https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56
- https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a
- https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896
- https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2