CVE-2021-47412 block: don't call rq_qos_ops->done_bio if the bio isn't tracked
A null pointer dereference in the Linux kernel block layer can cause a kernel panic, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47412?
CVE-2021-47412 is a high-severity vulnerability in Linux kernel, published on 21 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
block: don't call rq_qos_ops->done_bio if the bio isn't tracked
rq_qos framework is only applied on request based driver, so:
1) rq_qos_done_bio() needn't to be called for bio based driver
2) rq_qos_done_bio() needn't to be called for bio which isn't tracked, such as bios ended from error handling code.
Especially in bio_endio():
1) request queue is referred via bio->bi_bdev->bd_disk->queue, which may be gone since request queue refcount may not be held in above two cases
2) q->rq_qos may be freed in blk_cleanup_queue() when calling into __rq_qos_done_bio()
Fix the potential kernel panic by not calling rq_qos_ops->done_bio if the bio isn't tracked. This way is safe because both ioc_rqos_done_bio() and blkcg_iolatency_done_bio() are nop if the bio isn't tracked.
Which versions are affected by CVE-2021-47412?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47412?
Apply the vendor's patch.
Is CVE-2021-47412 being exploited?
There is no known exploitation of CVE-2021-47412 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47412, GHSA-6g88-wmq7-m8g5, ROOT-OS-DEBIAN-11-CVE-2021-47412, UBUNTU-CVE-2021-47412.