CVE-2021-47214 hugetlb, userfaultfd: fix reservation restore on userfaultfd error
A logic error in the Linux kernel's hugetlb subsystem causes a memory reservation leak, potentially leading to resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47214?
CVE-2021-47214 is a medium-severity denial of service vulnerability in Linux kernel, published on 10 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hugetlb, userfaultfd: fix reservation restore on userfaultfd error
Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we bail out using "goto out_release_unlock;" in the cases where idx >= size, or !huge_pte_none(), the code will detect that new_pagecache_page == false, and so call restore_reserve_on_error(). In this case I see restore_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h->resv_hugepages causing a 100% reproducible leak.
We should treat the is_continue case similar to adding a page into the pagecache and set new_pagecache_page to true, to indicate that there is no reservation to restore on the error path, and we need not call restore_reserve_on_error(). Rename new_pagecache_page to page_in_pagecache to make that clear.
Weakness: CWE-401
Which versions are affected by CVE-2021-47214?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47214?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-47214 being exploited?
There is no known exploitation of CVE-2021-47214 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47214, GHSA-rr47-vpr9-84rm, UBUNTU-CVE-2021-47214.