PT-2021-8026 · Linux+1 · Linux Kernel+1

Peter Robinson · Published 2021-03-25 · Updated 2024-04-18 · CVE-2021-46910

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.11.0+

Description The vulnerability is related to the kmap local() function in the Linux kernel, which doubles the number of per-CPU fixmap slots allocated for kmap local() to use half of them as guard regions. This causes the fixmap region to grow downwards beyond the start of its reserved window if the supported number of CPUs is large, and collide with the newly added virtual DT mapping right below it. One manifestation of this is EFI boot on a kernel built with NR CPUS=32 and CONFIG DEBUG KMAP LOCAL=y, which may pass the FDT in highmem, resulting in block entries below the fixmap region that the fixmap code misidentifies as fixmap table entries, and subsequently tries to dereference using a phys-to-virt translation that is only valid for lowmem.

Recommendations To resolve the issue, limit CONFIG NR CPUS to 16 when CONFIG DEBUG KMAP LOCAL=y. Also, fix the BUILD BUG ON() check that was supposed to catch this, by checking whether the region grows below the start address rather than above the end address. As a temporary workaround, consider disabling the kmap local() function until a patch is available.

Fix

Weakness Enumeration

CWE-118

Related Identifiers

BDU:2024-03151

CVE-2021-46910

Affected Products

Linux Kernel

Red Os

References · 17

• https://ubuntu.com/security/CVE-2021-46910 · Vendor Advisory
• https://git.kernel.org/stable/c/5965ac11b1d5fcb38464728931649cd9df79c7c9 · Patch
• https://git.kernel.org/stable/c/d624833f5984d484c5e3196f34b926f9e71dafee · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46910 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-46910 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46910 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-46910 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03151 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46910 · Vendor Advisory
• https://twitter.com/CVEnew/status/1762376177082142757 · Twitter Post
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.16 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-yadra-os-18-04-24 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://git.kernel.org/linus/d624833f5984d484c5e3196f34b926f9e71dafee · Note