Bugzilla – Bug 1220759
VUL-0: CVE-2021-47044: kernel: sched/fair: Fix shift-out-of-bounds in load_balance()
Last modified: 2024-06-07 12:17:33 UTC
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix shift-out-of-bounds in load_balance() Syzbot reported a handful of occurrences where an sd->nr_balance_failed can grow to much higher values than one would expect. A successful load_balance() resets it to 0; a failed one increments it. Once it gets to sd->cache_nice_tries + 3, this *should* trigger an active balance, which will either set it to sd->cache_nice_tries+1 or reset it to 0. However, in case the to-be-active-balanced task is not allowed to run on env->dst_cpu, then the increment is done without any further modification. This could then be repeated ad nauseam, and would explain the absurdly high values reported by syzbot (86, 149). VincentG noted there is value in letting sd->cache_nice_tries grow, so the shift itself should be fixed. That means preventing: """ If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined. """ Thus we need to cap the shift exponent to BITS_PER_TYPE(typeof(lefthand)) - 1. I had a look around for other similar cases via coccinelle: @expr@ position pos; expression E1; expression E2; @@ ( E1 >> E2@pos | E1 >> E2@pos ) @cst depends on expr@ position pos; expression expr.E1; constant cst; @@ ( E1 >> cst@pos | E1 << cst@pos ) @script:python depends on !cst@ pos << expr.pos; exp << expr.E2; @@ # Dirty hack to ignore constexpr if exp.upper() != exp: coccilib.report.print_report(pos[0], "Possible UB shift here") The only other match in kernel/sched is rq_clock_thermal() which employs sched_thermal_decay_shift, and that exponent is already capped to 10, so that one is fine. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47044 https://www.cve.org/CVERecord?id=CVE-2021-47044 https://git.kernel.org/stable/c/2f3eab368e313dba35fc2f51ede778bf7b030b54 https://git.kernel.org/stable/c/39a2a6eb5c9b66ea7c8055026303b3aa681b49a5 https://git.kernel.org/stable/c/805cea93e66ca7deaaf6ad3b67224ce47c104c2f https://git.kernel.org/stable/c/80862cbf76c2646f709a57c4517aefe0b094c774 https://bugzilla.redhat.com/show_bug.cgi?id=2267012
All affected branches already contain the fix. Closing.
SUSE-SU-2024:1465-1: An update that solves 145 vulnerabilities, contains five features and has five security fixes can now be installed. Category: security (important) Bug References: 1192145, 1209657, 1218336, 1218447, 1218479, 1218562, 1219170, 1219264, 1220320, 1220340, 1220366, 1220400, 1220411, 1220413, 1220414, 1220425, 1220426, 1220429, 1220432, 1220442, 1220445, 1220465, 1220468, 1220475, 1220484, 1220486, 1220487, 1220516, 1220521, 1220528, 1220529, 1220532, 1220536, 1220554, 1220556, 1220557, 1220560, 1220561, 1220566, 1220575, 1220580, 1220583, 1220611, 1220615, 1220621, 1220625, 1220630, 1220631, 1220638, 1220639, 1220640, 1220662, 1220663, 1220669, 1220670, 1220677, 1220678, 1220685, 1220687, 1220688, 1220692, 1220697, 1220703, 1220706, 1220733, 1220734, 1220739, 1220743, 1220749, 1220751, 1220753, 1220758, 1220759, 1220764, 1220768, 1220769, 1220777, 1220779, 1220785, 1220790, 1220794, 1220824, 1220829, 1220836, 1220846, 1220850, 1220861, 1220871, 1220883, 1220946, 1220954, 1220969, 1220979, 1220982, 1220985, 1220987, 1221015, 1221044, 1221058, 1221061, 1221077, 1221088, 1221276, 1221293, 1221532, 1221534, 1221541, 1221548, 1221552, 1221575, 1221605, 1221606, 1221608, 1221830, 1221931, 1221932, 1221934, 1221935, 1221949, 1221952, 1221965, 1221966, 1221969, 1221973, 1221974, 1221978, 1221989, 1221990, 1221991, 1221992, 1221993, 1221994, 1221996, 1221997, 1221998, 1221999, 1222000, 1222001, 1222002, 1222003, 1222004, 1222117, 1222422, 1222585, 1222619, 1222660, 1222664, 1222669, 1222706, 1222878 CVE References: CVE-2020-36780, CVE-2020-36781, CVE-2020-36782, CVE-2020-36783, CVE-2021-46908, CVE-2021-46909, CVE-2021-46911, CVE-2021-46914, CVE-2021-46917, CVE-2021-46918, CVE-2021-46919, CVE-2021-46920, CVE-2021-46921, CVE-2021-46922, CVE-2021-46930, CVE-2021-46931, CVE-2021-46933, CVE-2021-46938, CVE-2021-46939, CVE-2021-46943, CVE-2021-46944, CVE-2021-46950, CVE-2021-46951, CVE-2021-46956, CVE-2021-46958, CVE-2021-46959, CVE-2021-46960, CVE-2021-46961, CVE-2021-46962, CVE-2021-46963, CVE-2021-46971, CVE-2021-46976, CVE-2021-46980, CVE-2021-46981, CVE-2021-46983, CVE-2021-46984, CVE-2021-46988, CVE-2021-46990, CVE-2021-46991, CVE-2021-46992, CVE-2021-46998, CVE-2021-47000, CVE-2021-47001, CVE-2021-47003, CVE-2021-47006, CVE-2021-47009, CVE-2021-47014, CVE-2021-47015, CVE-2021-47017, CVE-2021-47020, CVE-2021-47026, CVE-2021-47034, CVE-2021-47035, CVE-2021-47038, CVE-2021-47044, CVE-2021-47045, CVE-2021-47046, CVE-2021-47049, CVE-2021-47051, CVE-2021-47055, CVE-2021-47056, CVE-2021-47058, CVE-2021-47063, CVE-2021-47065, CVE-2021-47068, CVE-2021-47070, CVE-2021-47071, CVE-2021-47073, CVE-2021-47077, CVE-2021-47082, CVE-2021-47087, CVE-2021-47095, CVE-2021-47097, CVE-2021-47100, CVE-2021-47101, CVE-2021-47109, CVE-2021-47110, CVE-2021-47112, CVE-2021-47114, CVE-2021-47117, CVE-2021-47118, CVE-2021-47119, CVE-2021-47120, CVE-2021-47130, CVE-2021-47136, CVE-2021-47137, CVE-2021-47138, CVE-2021-47139, CVE-2021-47141, CVE-2021-47142, CVE-2021-47144, CVE-2021-47150, CVE-2021-47153, CVE-2021-47160, CVE-2021-47161, CVE-2021-47164, CVE-2021-47165, CVE-2021-47166, CVE-2021-47167, CVE-2021-47168, CVE-2021-47169, CVE-2021-47170, CVE-2021-47171, CVE-2021-47172, CVE-2021-47173, CVE-2021-47174, CVE-2021-47175, CVE-2021-47176, CVE-2021-47177, CVE-2021-47179, CVE-2021-47180, CVE-2021-47181, CVE-2021-47183, CVE-2021-47185, CVE-2021-47189, CVE-2021-47202, CVE-2022-48626, CVE-2023-0160, CVE-2023-52454, CVE-2023-52469, CVE-2023-52470, CVE-2023-52474, CVE-2023-52476, CVE-2023-52477, CVE-2023-52492, CVE-2023-52500, CVE-2023-52508, CVE-2023-52509, CVE-2023-52572, CVE-2023-52575, CVE-2023-52583, CVE-2023-52590, CVE-2023-52591, CVE-2023-52607, CVE-2023-52628, CVE-2023-6270, CVE-2023-6531, CVE-2023-7042, CVE-2023-7192, CVE-2024-22099, CVE-2024-26600, CVE-2024-26614, CVE-2024-26642, CVE-2024-26704, CVE-2024-26733 Jira References: PED-5759, SLE-13706, SLE-15131, SLE-15172, SLE-15176 Maintenance Incident: [SUSE:Maintenance:33363](https://smelt.suse.de/incident/33363/) Sources used: SUSE Linux Enterprise Micro 5.1 (src): kernel-source-rt-5.3.18-150300.166.1 SUSE Linux Enterprise Micro 5.2 (src): kernel-source-rt-5.3.18-150300.166.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): kernel-source-rt-5.3.18-150300.166.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1489-1: An update that solves 157 vulnerabilities, contains five features and has four security fixes can now be installed. Category: security (important) Bug References: 1184942, 1186060, 1192145, 1194516, 1208995, 1209635, 1209657, 1212514, 1213456, 1217987, 1217988, 1217989, 1218336, 1218447, 1218479, 1218562, 1219170, 1219264, 1220320, 1220340, 1220366, 1220400, 1220411, 1220413, 1220414, 1220425, 1220426, 1220429, 1220432, 1220442, 1220445, 1220465, 1220468, 1220475, 1220484, 1220486, 1220487, 1220516, 1220521, 1220528, 1220529, 1220532, 1220554, 1220556, 1220557, 1220560, 1220561, 1220566, 1220575, 1220580, 1220583, 1220611, 1220615, 1220621, 1220625, 1220630, 1220631, 1220638, 1220639, 1220640, 1220641, 1220662, 1220663, 1220669, 1220670, 1220677, 1220678, 1220685, 1220687, 1220688, 1220692, 1220697, 1220703, 1220706, 1220733, 1220734, 1220739, 1220743, 1220745, 1220749, 1220751, 1220753, 1220758, 1220759, 1220764, 1220768, 1220769, 1220777, 1220779, 1220785, 1220790, 1220794, 1220824, 1220826, 1220829, 1220836, 1220846, 1220850, 1220861, 1220871, 1220883, 1220946, 1220954, 1220969, 1220979, 1220982, 1220985, 1220987, 1221015, 1221044, 1221058, 1221061, 1221077, 1221088, 1221276, 1221293, 1221532, 1221534, 1221541, 1221548, 1221552, 1221575, 1221605, 1221606, 1221608, 1221830, 1221931, 1221932, 1221934, 1221935, 1221949, 1221952, 1221965, 1221966, 1221969, 1221973, 1221974, 1221978, 1221989, 1221990, 1221991, 1221992, 1221993, 1221994, 1221996, 1221997, 1221998, 1221999, 1222000, 1222001, 1222002, 1222003, 1222004, 1222117, 1222422, 1222585, 1222619, 1222660, 1222664, 1222669, 1222706 CVE References: CVE-2020-36780, CVE-2020-36781, CVE-2020-36782, CVE-2020-36783, CVE-2021-23134, CVE-2021-29155, CVE-2021-46908, CVE-2021-46909, CVE-2021-46911, CVE-2021-46914, CVE-2021-46917, CVE-2021-46918, CVE-2021-46919, CVE-2021-46920, CVE-2021-46921, CVE-2021-46922, CVE-2021-46930, CVE-2021-46931, CVE-2021-46933, CVE-2021-46938, CVE-2021-46939, CVE-2021-46943, CVE-2021-46944, CVE-2021-46950, CVE-2021-46951, CVE-2021-46956, CVE-2021-46958, CVE-2021-46959, CVE-2021-46960, CVE-2021-46961, CVE-2021-46962, CVE-2021-46963, CVE-2021-46971, CVE-2021-46976, CVE-2021-46980, CVE-2021-46981, CVE-2021-46983, CVE-2021-46984, CVE-2021-46988, CVE-2021-46990, CVE-2021-46991, CVE-2021-46992, CVE-2021-46998, CVE-2021-47000, CVE-2021-47001, CVE-2021-47003, CVE-2021-47006, CVE-2021-47009, CVE-2021-47013, CVE-2021-47014, CVE-2021-47015, CVE-2021-47017, CVE-2021-47020, CVE-2021-47026, CVE-2021-47034, CVE-2021-47035, CVE-2021-47038, CVE-2021-47044, CVE-2021-47045, CVE-2021-47046, CVE-2021-47049, CVE-2021-47051, CVE-2021-47055, CVE-2021-47056, CVE-2021-47058, CVE-2021-47061, CVE-2021-47063, CVE-2021-47065, CVE-2021-47068, CVE-2021-47069, CVE-2021-47070, CVE-2021-47071, CVE-2021-47073, CVE-2021-47077, CVE-2021-47082, CVE-2021-47087, CVE-2021-47095, CVE-2021-47097, CVE-2021-47100, CVE-2021-47101, CVE-2021-47109, CVE-2021-47110, CVE-2021-47112, CVE-2021-47114, CVE-2021-47117, CVE-2021-47118, CVE-2021-47119, CVE-2021-47120, CVE-2021-47130, CVE-2021-47136, CVE-2021-47137, CVE-2021-47138, CVE-2021-47139, CVE-2021-47141, CVE-2021-47142, CVE-2021-47144, CVE-2021-47150, CVE-2021-47153, CVE-2021-47160, CVE-2021-47161, CVE-2021-47164, CVE-2021-47165, CVE-2021-47166, CVE-2021-47167, CVE-2021-47168, CVE-2021-47169, CVE-2021-47170, CVE-2021-47171, CVE-2021-47172, CVE-2021-47173, CVE-2021-47174, CVE-2021-47175, CVE-2021-47176, CVE-2021-47177, CVE-2021-47179, CVE-2021-47180, CVE-2021-47181, CVE-2021-47183, CVE-2021-47185, CVE-2021-47189, CVE-2022-0487, CVE-2022-4744, CVE-2022-48626, CVE-2023-0160, CVE-2023-1192, CVE-2023-28746, CVE-2023-35827, CVE-2023-52454, CVE-2023-52469, CVE-2023-52470, CVE-2023-52474, CVE-2023-52476, CVE-2023-52477, CVE-2023-52492, CVE-2023-52500, CVE-2023-52508, CVE-2023-52509, CVE-2023-52572, CVE-2023-52575, CVE-2023-52583, CVE-2023-52590, CVE-2023-52591, CVE-2023-52607, CVE-2023-52628, CVE-2023-6270, CVE-2023-6356, CVE-2023-6531, CVE-2023-6535, CVE-2023-6536, CVE-2023-7042, CVE-2023-7192, CVE-2024-22099, CVE-2024-26600, CVE-2024-26614, CVE-2024-26642, CVE-2024-26704, CVE-2024-26733 Jira References: PED-5759, SLE-13706, SLE-15131, SLE-15172, SLE-15176 Maintenance Incident: [SUSE:Maintenance:33221](https://smelt.suse.de/incident/33221/) Sources used: SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): kernel-syms-5.3.18-150300.59.158.1, kernel-obs-build-5.3.18-150300.59.158.1, kernel-source-5.3.18-150300.59.158.1, kernel-default-base-5.3.18-150300.59.158.1.150300.18.92.5 SUSE Enterprise Storage 7.1 (src): kernel-syms-5.3.18-150300.59.158.1, kernel-obs-build-5.3.18-150300.59.158.1, kernel-source-5.3.18-150300.59.158.1, kernel-default-base-5.3.18-150300.59.158.1.150300.18.92.5 SUSE Linux Enterprise Micro 5.1 (src): kernel-default-base-5.3.18-150300.59.158.1.150300.18.92.5 SUSE Linux Enterprise Micro 5.2 (src): kernel-default-base-5.3.18-150300.59.158.1.150300.18.92.5 SUSE Linux Enterprise Micro for Rancher 5.2 (src): kernel-default-base-5.3.18-150300.59.158.1.150300.18.92.5 openSUSE Leap 15.3 (src): kernel-syms-5.3.18-150300.59.158.1, kernel-livepatch-SLE15-SP3_Update_43-1-150300.7.3.5, kernel-obs-build-5.3.18-150300.59.158.1, kernel-default-base-5.3.18-150300.59.158.1.150300.18.92.5, kernel-source-5.3.18-150300.59.158.1, kernel-obs-qa-5.3.18-150300.59.158.1 SUSE Linux Enterprise Live Patching 15-SP3 (src): kernel-livepatch-SLE15-SP3_Update_43-1-150300.7.3.5 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): kernel-syms-5.3.18-150300.59.158.1, kernel-obs-build-5.3.18-150300.59.158.1, kernel-source-5.3.18-150300.59.158.1, kernel-default-base-5.3.18-150300.59.158.1.150300.18.92.5 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): kernel-syms-5.3.18-150300.59.158.1, kernel-obs-build-5.3.18-150300.59.158.1, kernel-source-5.3.18-150300.59.158.1, kernel-default-base-5.3.18-150300.59.158.1.150300.18.92.5 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
All done, closing.