PT-2021-8232 · Linux+3 · Linux Kernel+3
Gaosheng Cui
·
Published
2021-12-15
·
Updated
2024-12-02
·
CVE-2021-47603
CVSS v3.1
4.4
Medium
| Vector | AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the audit queue handling in the Linux kernel. If the audit daemon gets stuck in a stopped state, the kernel's kauditd thread() could get blocked attempting to send audit records to the userspace audit daemon. This could cause the audit queue to grow unbounded, potentially leading to a deadlock state. The problem is resolved by lowering the kernel thread's socket sending timeout and tweaking the kauditd send queue() function to better manage the audit queues when connection problems occur. With this patch, the backlog may temporarily grow beyond the defined limits when the audit daemon is stopped and the system is under heavy audit pressure, but kauditd thread() will continue to make progress and drain the queues as it would for other connection problems.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse