CVE-2021-47292
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/05/2024
Last modified:
23/12/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
io_uring: fix memleak in io_init_wq_offload()<br />
<br />
I got memory leak report when doing fuzz test:<br />
<br />
BUG: memory leak<br />
unreferenced object 0xffff888107310a80 (size 96):<br />
comm "syz-executor.6", pid 4610, jiffies 4295140240 (age 20.135s)<br />
hex dump (first 32 bytes):<br />
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................<br />
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........<br />
backtrace:<br />
[] kmalloc include/linux/slab.h:591 [inline]<br />
[] kzalloc include/linux/slab.h:721 [inline]<br />
[] io_init_wq_offload fs/io_uring.c:7920 [inline]<br />
[] io_uring_alloc_task_context+0x466/0x640 fs/io_uring.c:7955<br />
[] __io_uring_add_tctx_node+0x256/0x360 fs/io_uring.c:9016<br />
[] io_uring_add_tctx_node fs/io_uring.c:9052 [inline]<br />
[] __do_sys_io_uring_enter fs/io_uring.c:9354 [inline]<br />
[] __se_sys_io_uring_enter fs/io_uring.c:9301 [inline]<br />
[] __x64_sys_io_uring_enter+0xabc/0xc20 fs/io_uring.c:9301<br />
[] do_syscall_x64 arch/x86/entry/common.c:50 [inline]<br />
[] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80<br />
[] entry_SYSCALL_64_after_hwframe+0x44/0xae<br />
<br />
CPU0 CPU1<br />
io_uring_enter io_uring_enter<br />
io_uring_add_tctx_node io_uring_add_tctx_node<br />
__io_uring_add_tctx_node __io_uring_add_tctx_node<br />
io_uring_alloc_task_context io_uring_alloc_task_context<br />
io_init_wq_offload io_init_wq_offload<br />
hash = kzalloc hash = kzalloc<br />
ctx->hash_map = hash ctx->hash_map = hash
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.12 (including) | 5.13.6 (excluding) |
| cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.14:rc2:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



