CVE-2021-47249

Summary

In the Linux kernel, the following vulnerability has been resolved:

net: rds: fix memory leak in rds_recvmsg

Syzbot reported memory leak in rds. The problem was in unputted refcount in case of error.

int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, int msg_flags) { …

if (!rds_next_incoming(rs, &inc)) {
	...
}

After this "if" inc refcount incremented and

if (rds_cmsg_recv(inc, msg, rs)) {
	ret = -EFAULT;
	goto out;
}

… out: return ret; }

in case of rds_cmsg_recv() fail the refcount won't be decremented. And it's easy to see from ftrace log, that rds_inc_addref() don't have rds_inc_put() pair in rds_recvmsg() after rds_cmsg_recv()

  1.           |  rds_recvmsg() {
  2. 3.721 us | rds_inc_addref();
  3. 3.853 us | rds_message_inc_copy_to_user();
    • 10.395 us | rds_cmsg_recv();
    • 34.260 us | }

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxbdbe6fbc6a2f2ccfb384b141b257677d2a8d36fb < 8c3ec88b03e9e4ca117dcdc4204fd3edcd02084faffected
LinuxLinuxbdbe6fbc6a2f2ccfb384b141b257677d2a8d36fb < 423c6939758fb3b9cf5abbd1e7792068a5c4ae8caffected
LinuxLinuxbdbe6fbc6a2f2ccfb384b141b257677d2a8d36fb < 1f79bc8ae81c05eb112a53f981cb2c244ee50d02affected
LinuxLinuxbdbe6fbc6a2f2ccfb384b141b257677d2a8d36fb < 06b7cb0194bd1ede0dd27f3a946e7c0279fba44aaffected
LinuxLinuxbdbe6fbc6a2f2ccfb384b141b257677d2a8d36fb < 2038cd15eacdf7512755c27686822e0052eb9042affected
LinuxLinuxbdbe6fbc6a2f2ccfb384b141b257677d2a8d36fb < 5946fbf48355f5a8caeff72580c7658da5966b86affected
LinuxLinuxbdbe6fbc6a2f2ccfb384b141b257677d2a8d36fb < b25b60d076164edb3025e85aabd2cf50a5215b91affected
LinuxLinuxbdbe6fbc6a2f2ccfb384b141b257677d2a8d36fb < 49bfcbfd989a8f1f23e705759a6bb099de2cff9faffected
LinuxLinux2.6.30affected
LinuxLinux0 < 2.6.30unaffected
LinuxLinux4.4.274 <= 4.4.*unaffected
LinuxLinux4.9.274 <= 4.9.*unaffected
LinuxLinux4.14.238 <= 4.14.*unaffected
LinuxLinux4.19.196 <= 4.19.*unaffected
LinuxLinux5.4.128 <= 5.4.*unaffected
LinuxLinux5.10.46 <= 5.10.*unaffected
LinuxLinux5.12.13 <= 5.12.*unaffected
LinuxLinux5.13 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References