Bugzilla – Bug 1221547
VUL-0: CVE-2021-47123: kernel: io_uring: ltout double free on completion race
Last modified: 2024-06-05 12:53:45 UTC
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix ltout double free on completion race Always remove linked timeout on io_link_timeout_fn() from the master request link list, otherwise we may get use-after-free when first io_link_timeout_fn() puts linked timeout in the fail path, and then will be found and put on master's free. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47123 https://www.cve.org/CVERecord?id=CVE-2021-47123 https://git.kernel.org/stable/c/1f64f5e903b9d1d157875721e02adadc9d6f0a5d https://git.kernel.org/stable/c/447c19f3b5074409c794b350b10306e1da1ef4ba https://bugzilla.redhat.com/show_bug.cgi?id=2269843
Already fixed in cve/linux-5.14 and newer. cve/linux-5.3 and older are not affected. This was fixed over a year ago (2021-05-14) so no livepatches are needed.
commit 447c19f3b5074409c794b350b10306e1da1ef4ba [v5.13-rc2] Author: Pavel Begunkov <asml.silence@gmail.com> Date: Fri May 14 12:02:50 2021 +0100 io_uring: fix ltout double free on completion race Always remove linked timeout on io_link_timeout_fn() from the master request link list, otherwise we may get use-after-free when first io_link_timeout_fn() puts linked timeout in the fail path, and then will be found and put on master's free. Cc: stable@vger.kernel.org # 5.10+ Fixes: 90cd7e424969d ("io_uring: track link timeout's master explicitly") [v5.11-rc1] Reported-and-tested-by: syzbot+5a864149dd970b546223@syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/69c46bf6ce37fec4fdcd98f0882e18eb07ce693a.1620990121.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk> And, no scan result from check-kernel-fix: ./scripts/check-kernel-fix -c -a 447c19f3b5074409c794b350b10306e1da1ef4ba CVE-2021-47123 Using cached /tmp/joeyli-branches.conf As comment#1, we don't need to do anything. Reset assigner.
All done, closing.