CVE - CVE-2021-47589

CVE-ID
CVE-2021-47589	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbvf_probe` In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF. In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`. The KASAN logs are as follows: [ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411 URL:https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411 MISC:https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49 URL:https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49 MISC:https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a URL:https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9a MISC:https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc URL:https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fc MISC:https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54 URL:https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54 MISC:https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028 URL:https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028 MISC:https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac URL:https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106ac MISC:https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb URL:https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2beb
Assigning CNA
kernel.org
Date Record Created
20240524	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240524)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)