PT-2024-11079 · Linux+1 · Linux Kernel+1

Published 2021-03-10 · Updated 2025-01-08 · CVE-2021-46970

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A recent change in the Linux kernel created a dedicated workqueue for state-change work with WQ HIGHPRI and WQ MEM RECLAIM flags. However, the state-change work (mhi pm st worker) does not guarantee forward progress under memory pressure and may wait on various memory allocations, such as creating devices or loading firmware. This issue causes a warning in check flush dependency() since it flushes a non-reclaim workqueue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-02995

CVE-2021-46970

Affected Products

Astra Linux

Linux Kernel

References · 17

• https://ubuntu.com/security/CVE-2021-46970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46970 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-46970 · Vendor Advisory
• https://git.kernel.org/stable/c/0fccbf0a3b690b162f53b13ed8bc442ea33437dc · Patch
• https://osv.dev/vulnerability/CVE-2021-46970 · Vendor Advisory
• https://git.kernel.org/stable/c/abd1510c08a13c88d24b622a83c82e87ff1d3135 · Patch
• https://git.kernel.org/stable/c/ed541cff35cbdb695f0c98ef506dd7218883fc07 · Patch
• https://cve.org/CVERecord?id=CVE-2021-46970 · Security Note
• https://bdu.fstec.ru/vul/2025-02995 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46970 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46970 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.3 · Note
• https://git.kernel.org/linus/0fccbf0a3b690b162f53b13ed8bc442ea33437dc · Note
• https://lore.kernel.org/linux-cve-announce/2024022720-CVE-2021-46970-de08@gregkh/T/#u · Note
• https://twitter.com/CVEnew/status/1762551296337264812 · Twitter Post