CVE-2021-47634
- Source
- https://cve.org/CVERecord?id=CVE-2021-47634
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47634.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-47634
- Downstream
- Related
- Published
- 2025-02-26T06:37:05.173Z
- Modified
- 2026-02-14T23:33:32.553411Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix race condition between ctrlcdevioctl and ubicdevioctl
Hulk Robot reported a KASAN report about use-after-free: ================================================================== BUG: KASAN: use-after-free in _listdelentryvalid+0x13d/0x160 Read of size 8 at addr ffff888035e37d98 by task ubiattach/1385 [...] Call Trace: klistdecanddel+0xa7/0x4a0 klistput+0xc7/0x1a0 devicedel+0x4d4/0xed0 cdevdevicedel+0x1a/0x80 ubiattachmtddev+0x2951/0x34b0 [ubi] ctrlcdevioctl+0x286/0x2f0 [ubi]
Allocated by task 1414: deviceadd+0x60a/0x18b0 cdevdeviceadd+0x103/0x170 ubicreatevolume+0x1118/0x1a10 [ubi] ubicdev_ioctl+0xb7f/0x1ba0 [ubi]
Freed by task 1385: cdevdevicedel+0x1a/0x80 ubiremovevolume+0x438/0x6c0 [ubi] ubicdevioctl+0xbf4/0x1ba0 [ubi] [...] ==================================================================
The lock held by ctrlcdevioctl is ubidevicesmutex, but the lock held by ubicdevioctl is ubi->device_mutex. Therefore, the two locks can be concurrent.
ctrlcdevioctl contains two operations: ubiattach and ubidetach. ubidetach is bug-free because it uses reference counting to prevent concurrency. However, uifinit and uifclose in ubiattach may race with ubicdevioctl.
uifinit will race with ubicdevioctl as in the following stack. cpu1 cpu2 cpu3 |_|_ ctrlcdevioctl ubiattachmtddev uifinit ubicdevioctl ubicreatevolume cdevdeviceadd ubiaddvolume // sysfs exist killvolumes ubicdevioctl ubiremovevolume cdevdevicedel // first free ubifreevolume cdevdel // double free cdevdevicedel
And uifclose will race with ubicdevioctl as in the following stack. cpu1 cpu2 cpu3 |_|_ ctrlcdevioctl ubiattachmtddev uifinit ubicdevioctl ubicreatevolume cdevdeviceadd ubidebugfsinitdev //error goto outuif; uifclose killvolumes ubicdevioctl ubiremovevolume cdevdevicedel // first free ubifreevolume // double free
The cause of this problem is that commit 714fb87e8bc0 make device "available" before it becomes accessible via sysfs. Therefore, we roll back the modification. We will fix the race condition between ubi device creation and udev by removing ubigetdevice in volattributeshow and devattributeshow.This avoids accessing uninitialized ubidevices[ubinum].
ubigetdevice is used to prevent devices from being deleted during sysfs execution. However, now kernfs ensures that devices will not be deleted before all reference counting are released. The key process is shown in the following stack.
devicedel deviceremoveattrs deviceremovegroups sysfsremovegroups sysfsremovegroup removefiles kernfsremovebyname kernfsremovebynamens _kernfsremove kernfsdrain
- References
-
- https://git.kernel.org/stable/c/1a3f1cf87054833242fcd0218de0481cf855f888
- https://git.kernel.org/stable/c/3cbf0e392f173ba0ce425968c8374a6aa3e90f2e
- https://git.kernel.org/stable/c/432b057f8e847ae5a2306515606f8d2defaca178
- https://git.kernel.org/stable/c/5f9e9c223e48c264241d2f34d0bfc29e5fcb5c1b
- https://git.kernel.org/stable/c/a8ecee49259f8f78d91ddb329ab2be7e6fd01974
- https://git.kernel.org/stable/c/c32fe764191b8ae8b128588beb96e3718d9179d8
- https://git.kernel.org/stable/c/d727fd32cbd1abf3465f607021bc9c746f17b5a8
- https://git.kernel.org/stable/c/f149b1bd213820363731aa119e5011ca892a2aac
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed1860e379875dfe7271c649058aeddffe5afd9d0dIntroduced0 Unknown introduced commit / All previous commits are affectedFixed64291f7db5bd8150a74ad2036f1037e6a0428df2Introduced0 Unknown introduced commit / All previous commits are affectedFixed6e4664525b1db28f8c4e1130957f70a94c19213eIntroduced0 Unknown introduced commit / All previous commits are affectedFixedb562e44f507e863c6792946e4e1b1449fbbac85dIntroduced0 Unknown introduced commit / All previous commits are affectedFixedbfa76d49576599a4b9f9b7a71f23d73d6dcff735Introduced0 Unknown introduced commit / All previous commits are affectedFixedbfe01a5ba2490f299e1d2d5508cbbbadd897bbe9Introduced0 Unknown introduced commit / All previous commits are affectedFixedc16fa4f2ad19908a47c63d8fa436a1178438c7e7Introduced0 Unknown introduced commit / All previous commits are affectedFixedd8ec26d7f8287f5788a494f56e8814210f0e64be