Bug 1224979 (CVE-2021-47292)

Summary: VUL-0: CVE-2021-47292: kernel: io_uring: fix memleak in io_init_wq_offload()
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: gabriel.bertazi, gabriele.sonnu
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/406925/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-47292:5.5:(AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-05-22 12:35:28 UTC 
In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix memleak in io_init_wq_offload()

I got memory leak report when doing fuzz test:

BUG: memory leak
unreferenced object 0xffff888107310a80 (size 96):
comm "syz-executor.6", pid 4610, jiffies 4295140240 (age 20.135s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
backtrace:
[<000000001974933b>] kmalloc include/linux/slab.h:591 [inline]
[<000000001974933b>] kzalloc include/linux/slab.h:721 [inline]
[<000000001974933b>] io_init_wq_offload fs/io_uring.c:7920 [inline]
[<000000001974933b>] io_uring_alloc_task_context+0x466/0x640 fs/io_uring.c:7955
[<0000000039d0800d>] __io_uring_add_tctx_node+0x256/0x360 fs/io_uring.c:9016
[<000000008482e78c>] io_uring_add_tctx_node fs/io_uring.c:9052 [inline]
[<000000008482e78c>] __do_sys_io_uring_enter fs/io_uring.c:9354 [inline]
[<000000008482e78c>] __se_sys_io_uring_enter fs/io_uring.c:9301 [inline]
[<000000008482e78c>] __x64_sys_io_uring_enter+0xabc/0xc20 fs/io_uring.c:9301
[<00000000b875f18f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<00000000b875f18f>] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
[<000000006b0a8484>] entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU0                          CPU1
io_uring_enter                io_uring_enter
io_uring_add_tctx_node        io_uring_add_tctx_node
__io_uring_add_tctx_node      __io_uring_add_tctx_node
io_uring_alloc_task_context   io_uring_alloc_task_context
io_init_wq_offload            io_init_wq_offload
hash = kzalloc                hash = kzalloc
ctx->hash_map = hash          ctx->hash_map = hash <- one of the hash is leaked

When calling io_uring_enter() in parallel, the 'hash_map' will be leaked,
add uring_lock to protect 'hash_map'.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47292
https://www.cve.org/CVERecord?id=CVE-2021-47292
https://git.kernel.org/stable/c/362a9e65289284f36403058eea2462d0330c1f24
https://git.kernel.org/stable/c/502731a03f27cba1513fbbff77e508185ffce5bb
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2021/CVE-2021-47292.mbox
Comment 1 Gabriel Krisman Bertazi 2024-05-22 23:38:39 UTC 
No branches affected since the issue only existed between 5.12 and 5.14.  

Back to security team.

[0:krisman@cartola kernel-source]$ ../scripts/scripts/check-kernel-fix -r CVE-2021-47292
362a9e652892 ("io_uring: fix memleak in io_init_wq_offload()") merged v5.14-rc3~12^2~3
Fixes: e941894eae31 ("io-wq: make buffered file write hashed work map per-ctx") merged v5.12-rc1~8^2~4
Security fix for CVE-2021-47292 bsc#1224979 with CVSS 5.5
Experts candidates: krisman@suse.de
..............................
Comment 2 Gabriele Sonnu 2024-06-10 12:51:29 UTC 
All done, closing.