CVE-2021-46988 userfaultfd: release page in error path to avoid BUG_ON
A use-after-free vulnerability in the Linux kernel's userfaultfd subsystem allows local attackers to trigger a kernel panic via a specific race condition.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-46988?
CVE-2021-46988 is a medium-severity use after free vulnerability in Linux kernel, published on 28 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
userfaultfd: release page in error path to avoid BUG_ON
Consider the following sequence of events:
1. Userspace issues a UFFD ioctl, which ends up calling into shmem_mfill_atomic_pte(). We successfully account the blocks, we shmem_alloc_page(), but then the copy_from_user() fails. We return -ENOENT. We don't release the page we allocated. 2. Our caller detects this error code, tries the copy_from_user() after dropping the mmap_lock, and retries, calling back into shmem_mfill_atomic_pte(). 3. Meanwhile, let's say another process filled up the tmpfs being used. 4. So shmem_mfill_atomic_pte() fails to account blocks this time, and immediately returns - without releasing the page.
This triggers a BUG_ON in our caller, which asserts that the page should always be consumed, unless -ENOENT is returned.
To fix this, detect if we have such a "dangling" page when accounting fails, and if so, release it before returning.
Weakness: CWE-416
Which versions are affected by CVE-2021-46988?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-46988?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2021-46988 being exploited?
There is no known exploitation of CVE-2021-46988 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-46988, GHSA-w36p-947m-7c32, UBUNTU-CVE-2021-46988.