Vulnerability · Published May 21, 2024 · Assigned by Linux
CVE-2021-47292io_uring: fix memleak in io_init_wq_offload()
Medium 5.5
In plain English
A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix memleak in io_init_wq_offload() I got memory leak report when doing fuzz test: BUG: memory leak unreferenced object 0xffff888107310a80 (size 96): comm "syz-executor.6", pid 4610, jiffies 4295140240 (age 20.135s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... backtrace: [<000000001974933b>] kmalloc include/linux/slab.h:591 [inline] [<000000001974933b>] kzalloc include/linux/slab.h:721 [inline] [<000000001974933b>] io_init_wq_offload fs/io_uring.c:7920 [inline] [<000000001974933b>] io_uring_alloc_task_context+0x466/0x640 fs/io_uring.c:7955 [<0000000039d0800d>] __io_uring_add_tctx_node+0x256/0x360 fs/io_uring.c:9016 [<000000008482e78c>] io_uring_add_tctx_node fs/io_uring.c:9052 [inline] [<000000008482e78c>] __do_sys_io_uring_enter fs/io_uring.c:9354 [inline] [<000000008482e78c>] __se_sys_io_uring_enter fs/io_uring.c:9301 [inline] [<000000008482e78c>] __x64_sys_io_uring_enter+0xabc/0xc20 fs/io_uring.c:9301 [<00000000b875f18f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<00000000b875f18f>] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 [<000000006b0a8484>] entry_SYSCALL_64_after_hwframe+0x44/0xae CPU0 CPU1 io_uring_enter io_uring_enter io_uring_add_tctx_node io_uring_add_tctx_node __io_uring_add_tctx_node __io_uring_add_tctx_node io_uring_alloc_task_context io_uring_alloc_task_context io_init_wq_offload io_init_wq_offload hash = kzalloc hash = kzalloc ctx->hash_map = hash ctx->hash_map = hash <- one of the hash is leaked When calling io_uring_enter() in parallel, the 'hash_map' will be leaked, add uring_lock to protect 'hash_map'.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-aws-6.2 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-azure-6.2 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | no fix listed | UBUNTU-CVE-2021-47292 |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | no fix listed | UBUNTU-CVE-2021-47292 |