Bug 1221547 (CVE-2021-47123)

Summary: VUL-0: CVE-2021-47123: kernel: io_uring: ltout double free on completion race
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Major    
Priority: P3 - Medium CC: carlos.lopez, jlee, meissner
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/397857/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-47123:7.0:(AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 1221758    

Description SMASH SMASH 2024-03-18 08:30:07 UTC 
In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix ltout double free on completion race

Always remove linked timeout on io_link_timeout_fn() from the master
request link list, otherwise we may get use-after-free when first
io_link_timeout_fn() puts linked timeout in the fail path, and then
will be found and put on master's free.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47123
https://www.cve.org/CVERecord?id=CVE-2021-47123
https://git.kernel.org/stable/c/1f64f5e903b9d1d157875721e02adadc9d6f0a5d
https://git.kernel.org/stable/c/447c19f3b5074409c794b350b10306e1da1ef4ba
https://bugzilla.redhat.com/show_bug.cgi?id=2269843
Comment 1 Carlos López 2024-03-18 08:31:08 UTC 
Already fixed in cve/linux-5.14 and newer. cve/linux-5.3 and older are not affected.

This was fixed over a year ago (2021-05-14) so no livepatches are needed.
Comment 2 Joey Lee 2024-03-22 08:56:39 UTC 
commit 447c19f3b5074409c794b350b10306e1da1ef4ba    [v5.13-rc2]
Author: Pavel Begunkov <asml.silence@gmail.com>
Date:   Fri May 14 12:02:50 2021 +0100

    io_uring: fix ltout double free on completion race
    
    Always remove linked timeout on io_link_timeout_fn() from the master
    request link list, otherwise we may get use-after-free when first
    io_link_timeout_fn() puts linked timeout in the fail path, and then
    will be found and put on master's free.
    
    Cc: stable@vger.kernel.org # 5.10+
    Fixes: 90cd7e424969d ("io_uring: track link timeout's master explicitly")     [v5.11-rc1]
    Reported-and-tested-by: syzbot+5a864149dd970b546223@syzkaller.appspotmail.com
    Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
    Link: https://lore.kernel.org/r/69c46bf6ce37fec4fdcd98f0882e18eb07ce693a.1620990121.git.asml.silence@gmail.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

And, no scan result from check-kernel-fix:

./scripts/check-kernel-fix -c -a 447c19f3b5074409c794b350b10306e1da1ef4ba CVE-2021-47123
Using cached /tmp/joeyli-branches.conf

As comment#1, we don't need to do anything. Reset assigner.
Comment 3 Andrea Mattiazzo 2024-06-05 12:53:45 UTC 
All done, closing.