CVE Descriptions Signed-off-by: Sasha Levin <sashal@kernel.org>
diff --git a/CVE-2021-46915 b/CVE-2021-46915 new file mode 100644 index 0000000..19e3e6f --- /dev/null +++ b/CVE-2021-46915
@@ -0,0 +1,8 @@ +The vulnerability, tracked as CVE-2021-46915, is a divide error in the `nft_limit_init` function of the Linux kernel's netfilter subsystem. The issue arises because the function uses the `div_u64()` function to divide an unsigned 64-bit integer by an unsigned 32-bit integer, which can lead to a divide error. + +The correct approach would be to use the `div64_u64()` function, which is designed for dividing unsigned 64-bit integers. The vulnerability was introduced in kernel version 4.13 and fixed in various subsequent versions, including 4.14.232, 4.19.189, 5.4.114, 5.10.32, 5.11.16, and 5.12. + +The affected file is `net/netfilter/nft_limit.c`. The Linux kernel CVE team recommends updating to the latest stable kernel version to resolve this issue, as individual changes are not tested or supported by the kernel community. If updating is not possible, the individual commits to fix this issue can be found at the specified Git commit IDs. + +The vulnerability was discovered and reported with a crash dump from a system running a vulnerable kernel version. The Linux kernel CVE team has assigned CVE-2021-46915 to this issue, and the official CVE entry will be updated if fixes are backported to older supported kernel versions. +
diff --git a/CVE-2021-46916 b/CVE-2021-46916 new file mode 100644 index 0000000..b5fec3d --- /dev/null +++ b/CVE-2021-46916
@@ -0,0 +1,6 @@ +The vulnerability, identified as CVE-2021-46916, affects the ixgbe driver in the Linux kernel. Specifically, it occurs when performing the ethtool loopback test, which causes a NULL pointer dereference. This happens because there is no q_vector associated with the test ring when it is set up, and interrupts are not normally added to the test rings. + +The issue arises due to the lack of a q_vector check before returning a napi_id value. To fix this, code has been added to check for a q_vector before returning a napi_id value. If a q_vector is not present, it will return a value of 0, preventing the NULL pointer dereference. + +The vulnerability was introduced in kernel version 5.11 with commit b02e5a0ebb17 and fixed in versions 5.11.16 with commit 758d19098df4 and 5.12 with commit 31166efb1cee. The affected file is `drivers/net/ethernet/intel/ixgbe/ixgbe_main.c`. To mitigate this issue, the Linux kernel CVE team recommends updating to the latest stable kernel version or applying the individual commits that fix the issue. +
diff --git a/CVE-2021-46917 b/CVE-2021-46917 new file mode 100644 index 0000000..6f43876 --- /dev/null +++ b/CVE-2021-46917
@@ -0,0 +1,6 @@ +The vulnerability, identified as CVE-2021-46917, affects the dmaengine subsystem in the Linux kernel, specifically the idxd (Index DMA) driver. The issue arises from a pre-release silicon erratum workaround that was mistakenly included in the upstream code. This workaround fails to clear the WQCFG registers during workqueue (WQ) reset, leading to potential issues with future devices. + +The problem is resolved by using the WQ reset command instead of blasting the MMIO region. This fix ensures that the WQCFG registers are properly cleared, preventing any potential clobbering of registers in future devices. The affected files include `drivers/dma/idxd/device.c`, `drivers/dma/idxd/idxd.h`, and `drivers/dma/idxd/sysfs.c`. + +The vulnerability was introduced in kernel version 5.8 with commit da32b28c95a7 and has been fixed in versions 5.10.32, 5.11.16, and 5.12 with commits e5eb9757fe4c, f7dc8f561916, and ea9aadc06a9f, respectively. The Linux kernel CVE team recommends updating to the latest stable kernel version to resolve this issue, as individual changes are not tested or supported in isolation. +
diff --git a/CVE-2021-46918 b/CVE-2021-46918 new file mode 100644 index 0000000..3e78b14 --- /dev/null +++ b/CVE-2021-46918
@@ -0,0 +1,6 @@ +The vulnerability, assigned CVE-2021-46918, affects the dmaengine idxd driver in the Linux kernel. The issue arises when the MSIX permission entries are not properly cleared during device shutdown, leading to the MSIX entries remaining enabled and the PASID (Pass-through IDs) still programmed. This is a problem because it does not mirror the enabling of the MSIX entries on probe. + +The fix involves adding code to disable and clear the MSIX permission entries on device shutdown, ensuring that the MSIX entries are properly disabled when the device is shut down. The vulnerability was introduced in kernel version 5.11 with commit 8e50d392652f and was fixed in versions 5.11.16 with commit c84b8982d7aa and 5.12 with commit 6df0e6c57dfc. + +The affected files are drivers/dma/idxd/device.c, drivers/dma/idxd/idxd.h, and drivers/dma/idxd/init.c. The Linux kernel CVE team recommends updating to the latest stable kernel version to fix this issue, as individual changes are not tested or supported alone. +
diff --git a/CVE-2021-46919 b/CVE-2021-46919 new file mode 100644 index 0000000..5337888 --- /dev/null +++ b/CVE-2021-46919
@@ -0,0 +1,6 @@ +The CVE-2021-46919 vulnerability affects the Linux kernel's dmaengine subsystem, specifically the idxd driver. The issue arises from an incorrect permission state check when storing the workqueue (WQ) size. Currently, the code allows changing the WQ size when the device is enabled but the WQ is disabled. However, according to the correct behavior, the WQ size can only be changed when the device is disabled. + +The vulnerability was introduced in kernel version 5.6 with commit c52ca478233c and has been fixed in versions 5.10.32 (commit 4ecf25595273), 5.11.16 (commit 05b7791c4c4a), and 5.12 (commit 0fff71c5a311). The affected file is drivers/dma/idxd/sysfs.c. + +To mitigate this issue, the Linux kernel CVE team recommends updating to the latest stable kernel version. If updating is not possible, the individual changes to resolve this issue can be found in the specified commits. However, cherry-picking individual commits is not recommended or supported by the Linux kernel community. +
diff --git a/CVE-2021-46920 b/CVE-2021-46920 new file mode 100644 index 0000000..2c3bc35 --- /dev/null +++ b/CVE-2021-46920
@@ -0,0 +1,6 @@ +The vulnerability CVE-2021-46920 affects the dmaengine idxd driver in the Linux kernel, specifically in the `irq.c` file. The issue arises when the driver writes over the SWERR and OVERFLOW bits without properly reading them first, potentially clobbering the OVERFLOW bit. To fix this, the driver should read the bits before writing to avoid overwriting important error information. + +The vulnerability was introduced in kernel version 5.6 with commit `bfe1d56091c1` and has been fixed in versions 5.10.32 with commit `a5ad12d5d69c`, 5.11.16 with commit `02981a44a0e4`, and 5.12 with commit `ea941ac294d7`. To mitigate this issue, users are recommended to update to the latest stable kernel version. If updating is not possible, individual changes can be cherry-picked from the specified commits. + +The root cause of the issue lies in the incorrect handling of register writes, where the driver fails to preserve the error information stored in the OVERFLOW bit. By reading the bits before writing, the driver ensures that important error information is preserved and not lost due to overwriting. +
diff --git a/CVE-2021-46921 b/CVE-2021-46921 new file mode 100644 index 0000000..f093413 --- /dev/null +++ b/CVE-2021-46921
@@ -0,0 +1,6 @@ +The vulnerability resides in the Linux kernel's queued write lock slowpath function, specifically in the ordering of atomic operations. When a writer acquires the lock using `queued_write_lock_slowpath()`, it loops checking the value with `atomic_cond_read_acquire()` but only truly acquires the lock when the compare-and-exchange (cmpxchg) operation is completed successfully. However, this exposes a window between the acquire and the cmpxchg to an A-B-A problem, allowing reads following the lock acquisition to observe values speculatively before the write lock is truly acquired. + +This can lead to issues like the one observed in epoll, where a reader does an exchange while holding the read lock, but the writer can see a value change out from under it. The fix involves switching the cmpxchg to use acquire semantics, which addresses this issue and allows the `atomic_cond_read` to be switched to use relaxed semantics. + +The vulnerability was introduced in Linux kernel version 4.15 with commit b519b56e378e and has been fixed in various versions, including 4.19.189, 5.4.115, 5.10.33, 5.11.17, and 5.12. The affected file is `kernel/locking/qrwlock.c`. The Linux kernel CVE team recommends updating to the latest stable kernel version to resolve this issue, rather than cherry-picking individual commits. +
diff --git a/CVE-2021-46922 b/CVE-2021-46922 new file mode 100644 index 0000000..0629935 --- /dev/null +++ b/CVE-2021-46922
@@ -0,0 +1,6 @@ +The vulnerability, tracked as CVE-2021-46922, lies in the Linux kernel's trusted key implementation, specifically in the TPM (Trusted Platform Module) reservation mechanism for seal and unseal operations. The issue arises from a lost `tpm_try_get_ops()` call in the `tpm2_seal_trusted()` function, which causes an imbalance in TPM operation puts, leading to oopses on TIS-based hardware. + +The problem was introduced in kernel versions 5.10.20 and 5.11.3, with commits 67118bb78d72 and 498b8fc1cdc1, respectively. The fix, which reverts the lost `tpm_try_get_ops()` call, was applied in kernel versions 5.10.33 and 5.11.17, with commits bf84ef2dd2cc and 39c8d760d44c, respectively. + +The affected file is `security/keys/trusted-keys/trusted_tpm2.c`. The Linux kernel CVE team recommends updating to the latest stable kernel version to resolve this issue, as well as other bugfixes. If updating is not possible, individual changes can be cherry-picked from the specified commits. +
diff --git a/CVE-2021-46923 b/CVE-2021-46923 new file mode 100644 index 0000000..3efe15a --- /dev/null +++ b/CVE-2021-46923
@@ -0,0 +1,6 @@ +The vulnerability occurs in the `fs/mount_setattr` function of the Linux kernel, specifically when building a `mount_kattr` structure. In certain scenarios, such as when an idmapped mount is requested and path lookup fails, the function would return early without calling `finish_mount_kattr()`, leading to a reference leak. + +This leak occurs because `mount_kattr` takes additional references during its construction, which are not properly released in case of failure. By not calling `finish_mount_kattr()` in all cases (both success and failure), these references are leaked, potentially causing issues with the kernel's memory management. + +The vulnerability was introduced in Linux kernel version 5.12 with commit 9caccd41541a and has been fixed in versions 5.15.13 with commit 47b5d0a7532d and 5.16 with commit 012e332286e2. The affected file is `fs/namespace.c`. To mitigate this issue, the Linux kernel CVE team recommends updating to the latest stable kernel version, as individual changes are not tested or supported alone. +
diff --git a/CVE-2021-46924 b/CVE-2021-46924 new file mode 100644 index 0000000..d5b6696 --- /dev/null +++ b/CVE-2021-46924
@@ -0,0 +1,8 @@ +The vulnerability, tracked as CVE-2021-46924, is a memory leak in the NFC (Near Field Communication) st21nfca driver. Specifically, when the device probe or remove functions are called, the `phy->pending_skb` object is allocated but not freed in error handling paths, leading to a memory leak. + +The issue was introduced in kernel version 3.16 with commit 68957303f44a and has been fixed in multiple subsequent versions, including 4.14.261, 4.19.224, 5.4.170, 5.10.90, 5.15.13, and 5.16. + +The affected file is `drivers/nfc/st21nfca/i2c.c`. The fix involves freeing the `pending_skb` object in error and remove paths to prevent the memory leak. + +To mitigate this issue, it is recommended to update to the latest stable kernel version. If updating is not possible, individual changes can be cherry-picked from the provided commit hashes. However, the Linux kernel community does not support or recommend cherry-picking individual commits, as they are only tested as part of a larger kernel release. +
diff --git a/CVE-2021-46925 b/CVE-2021-46925 new file mode 100644 index 0000000..4bce8be --- /dev/null +++ b/CVE-2021-46925
@@ -0,0 +1,6 @@ +The Linux kernel has a vulnerability in the SMC (Shared Memory Communications) protocol, specifically in the `smc_cdc_tx_handler()` function. This function can cause a kernel panic when it tries to access the `smc_sock` structure after it has been freed by `smc_release()`. This race condition occurs because `smc_cdc_tx_handler()` checks for the existence of an SMC connection, but `smc_release()` may have already dismissed and released the socket before `smc_cdc_tx_handler()` accesses it. + +To fix this issue, a reference count was added to the `smc_connection` structure to track in-flight CDC messages. This ensures that the `smc_sock` is not released until all pending CDC messages are completed or failed. Additionally, changes were made to the IB (InfiniBand) device removal routine to wait for all QPs (Queue Pairs) on a device to be destroyed before destroying CQs (Completion Queues) on that device. + +This vulnerability was introduced in Linux kernel version 4.11 and fixed in versions 5.10.90, 5.15.13, and 5.16. The affected files are `net/smc/*`. The recommended mitigation is to update to the latest stable kernel version. Individual patches can be found at the specified commits if updating to the latest release is not possible. +
diff --git a/CVE-2021-46926 b/CVE-2021-46926 new file mode 100644 index 0000000..228e673 --- /dev/null +++ b/CVE-2021-46926
@@ -0,0 +1,6 @@ +The vulnerability resides in the ALSA (Advanced Linux Sound Architecture) driver, specifically in the `intel-sdw-acpi.c` file. The issue arises from the incorrect ordering of operations when detecting a SoundWire controller using ACPI (Advanced Configuration and Power Interface). + +Prior to the patch, the code would set a pointer to an ACPI handle before verifying that it indeed points to a SoundWire controller. This could lead to issues where the graph walk continues despite the pointer being invalid, ultimately resulting in failures. + +The patched code rectifies this by only setting the information provided to the caller when a legitimate SoundWire controller is detected. This ensures that the pointer is only set when it points to a valid controller, mitigating potential issues. +
diff --git a/CVE-2021-46927 b/CVE-2021-46927 new file mode 100644 index 0000000..d720d3a --- /dev/null +++ b/CVE-2021-46927
@@ -0,0 +1,8 @@ +The vulnerability, identified as CVE-2021-46927, affects the Linux kernel's nitro_enclaves module. Specifically, it occurs when setting enclave memory regions using `get_user_pages()` without proper locking, leading to an `mmap_assert_locked()` failure. + +The issue arises because of a commit (5b78ed24e8ec) that added `mmap_assert_locked()` annotations to the `find_vma*()` functions. This change causes the `get_user_pages()` call to trigger the `mmap_assert_locked()` check, which fails due to the lack of proper locking. + +To fix this issue, the kernel developers replaced the `get_user_pages()` call with `get_user_pages_unlocked()`, similar to how `mmap_read_lock()` is used in conjunction with `get_user_pages()`. This ensures that the necessary locks are held when setting enclave memory regions. + +The vulnerability was introduced in Linux kernel version 5.15 and fixed in versions 5.15.13 and 5.16. The affected file is `drivers/virt/nitro_enclaves/ne_misc_dev.c`. To mitigate this issue, users are recommended to update to the latest stable kernel version. If updating is not possible, individual changes can be cherry-picked from the provided commits. +
diff --git a/CVE-2021-46928 b/CVE-2021-46928 new file mode 100644 index 0000000..96f777a --- /dev/null +++ b/CVE-2021-46928
@@ -0,0 +1,6 @@ +The Linux kernel has a vulnerability in its parisc architecture, specifically in the handling of instruction access rights traps. When a trap 7 (Instruction access rights) occurs, it means the CPU couldn't execute an instruction due to missing execute permissions on the memory region. In this case, the CPU doesn't even fetch the instruction from memory and thus doesn't store it in the cr19 (IIR) register before calling the trap handler. As a result, the trap handler finds some random old stale value in cr19. + +This vulnerability is resolved by overwriting the stale IIR value with a constant magic "bad food" value (0xbaadf00d) in the hope that people won't try to understand the various random IIR values in trap 7 dumps. This patch ensures that the stale IIR value is cleared, preventing any potential issues that may arise from its presence. + +The affected files are arch/parisc/kernel/traps.c, and the vulnerability has been fixed in kernel versions 5.10.90, 5.15.13, and 5.16 with commits d01e9ce1af61, e96373f0a5f4, and 484730e5862f respectively. The Linux kernel CVE team recommends updating to the latest stable kernel version to resolve this issue, as individual changes are never tested alone and cherry-picking individual commits is not recommended or supported by the Linux kernel community. +
diff --git a/CVE-2021-46929 b/CVE-2021-46929 new file mode 100644 index 0000000..e9260b2 --- /dev/null +++ b/CVE-2021-46929
@@ -0,0 +1,8 @@ +The vulnerability CVE-2021-46929 is a use-after-free issue in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The problem occurs when an association (asoc) is peeled off, and the old socket (sk) is freed after being retrieved by asoc->base.sk, but before calling lock_sock(sk). This can lead to a use-after-free scenario. + +To fix this issue, the patch uses call_rcu() to delay the endpoint free, which ensures that the endpoint is not freed until the RCU (Read-Copy Update) grace period has ended. The sock_put and ep free operations are moved into sctp_endpoint_destroy_rcu(), making it safe to hold the endpoint under rcu_read_lock in sctp_transport_traverse_process(). If sctp_endpoint_hold() returns true, it means the endpoint is still alive, and it's safe to continue dumping it. If it returns false, it means the endpoint is dead and can be freed after rcu_read_unlock. + +The vulnerability was introduced in kernel version 4.14 with commit d25adbeb0cdb and has been fixed in various kernel versions, including 4.14.261, 4.19.224, 5.4.170, 5.10.90, 5.15.13, and 5.16. The affected files are include/net/sctp/sctp.h, include/net/sctp/structs.h, net/sctp/diag.c, net/sctp/endpointola.c, and net/sctp/socket.c. + +The Linux kernel CVE team recommends updating to the latest stable kernel version to fix this issue, as individual changes are never tested alone and cherry-picking individual commits is not supported. +
diff --git a/CVE-2021-46930 b/CVE-2021-46930 new file mode 100644 index 0000000..7e554d4 --- /dev/null +++ b/CVE-2021-46930
@@ -0,0 +1,10 @@ +The CVE-2021-46930 vulnerability is a use-after-free bug in the Linux kernel's `mtu3` USB gadget driver. It occurs due to the uninitialization of a `list_head` structure, leading to a crash or potential exploitation when attempting to free a list entry. + +The bug was introduced in kernel version 5.2 with commit `83374e035b62` and was fixed in various subsequent kernel versions, including 5.4.170, 5.10.90, 5.15.13, and 5.16. + +The affected file is `drivers/usb/mtu3/mtu3_gadget.c`. The vulnerability can be mitigated by updating to the latest stable kernel version or applying individual patches from specific commits (listed in the CVE report). + +The use-after-free bug was detected using KASAN (Kernel Address Sanitizer) and manifests as a crash when attempting to delete an entry from a list. The call trace shows that the `__list_del_entry_valid` function is called with an uninitialized `list_head`, leading to the crash. + +This vulnerability highlights the importance of proper initialization and memory management in kernel code, especially when working with complex data structures like linked lists. +
diff --git a/CVE-2021-46931 b/CVE-2021-46931 new file mode 100644 index 0000000..807e98f --- /dev/null +++ b/CVE-2021-46931
@@ -0,0 +1,8 @@ +The vulnerability is in the mlx5e driver, specifically in the `mlx5e_tx_reporter_dump_sq` function. This function casts its void pointer argument to a struct `mlx5e_txqsq *`, but in the TX timeout recovery flow, the argument is actually of type `struct mlx5e_tx_timeout_ctx *`. This mismatch can lead to a kernel stack overflow and eventually cause a fatal exception. + +The issue arises when the `mlx5e_tx_reporter_dump_sq` function is called with an incorrect argument type. The function expects a pointer to a `struct mlx5e_txqsq`, but in certain situations, such as during TX timeout recovery, it receives a pointer to a `struct mlx5e_tx_timeout_ctx` instead. This causes the function to access memory outside of its intended bounds, leading to a kernel stack overflow. + +To fix this bug, a wrapper function has been added to extract the `sq` from the `struct mlx5e_tx_timeout_ctx` and set it as the dump callback in the TX timeout recovery flow. This ensures that the correct argument type is used when calling the `mlx5e_tx_reporter_dump_sq` function. + +The vulnerability was introduced in kernel version 5.7 with commit 5f29458b77d5 and has been fixed in versions 5.10.90, 5.15.13, and 5.16 with commits 73665165b64a, 07f13d58a8ec, and 918fc3855a65 respectively. +
diff --git a/CVE-2021-46932 b/CVE-2021-46932 new file mode 100644 index 0000000..1c9e4dc --- /dev/null +++ b/CVE-2021-46932
@@ -0,0 +1,8 @@ +The vulnerability, tracked as CVE-2021-46932, is related to the initialization of work in the appletouch driver. Specifically, the issue arises because the `input_dev->close()` function calls `cancel_work_sync(&dev->work)`, but the initialization of `dev->work` occurs after the `input_register_device()` call. This can lead to a situation where `work->func == NULL`, resulting in a warning in `__flush_work()`. + +The problem is that the work structure is not initialized before registering the input device, which can cause issues when trying to cancel or flush the work. To fix this issue, the initialization of `dev->work` needs to be moved before registering the input device. + +This vulnerability was introduced in kernel version 2.6.23 with commit 5a6eb676d3bc and has been fixed in various kernel versions, including 4.4.298, 4.9.296, 4.14.261, 4.19.224, 5.4.170, 5.10.90, 5.15.13, and 5.16. + +The affected file is `drivers/input/mouse/appletouch.c`. The Linux kernel CVE team recommends updating to the latest stable kernel version to fix this issue, as well as other bugfixes. If updating is not possible, individual changes can be cherry-picked from the specified commits. +