7.8

CVE-2021-47254

gfs2: Fix use-after-free in gfs2_glock_shrink_scan

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix use-after-free in gfs2_glock_shrink_scan

The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to
remove the glock from the lru list in __gfs2_glock_put().

On the shrink scan path, the same flag is cleared under lru_lock but because
of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the
put side can be made without deleting the glock from the lru list.

Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to
ensure correct behavior on both sides - clear GLF_LRU after list_del under
lru_lock.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
LinuxLinux Kernel Version >= 4.4.181 < 4.4.274
LinuxLinux Kernel Version >= 4.9.180 < 4.9.274
LinuxLinux Kernel Version >= 4.14.123 < 4.14.238
LinuxLinux Kernel Version >= 4.19.47 < 4.19.196
LinuxLinux Kernel Version >= 5.0.20 < 5.1
LinuxLinux Kernel Version >= 5.1.6 < 5.4.127
LinuxLinux Kernel Version >= 5.5 < 5.10.45
LinuxLinux Kernel Version >= 5.11 < 5.12.12
LinuxLinux Kernel Version5.13 Updaterc1
LinuxLinux Kernel Version5.13 Updaterc2
LinuxLinux Kernel Version5.13 Updaterc3
LinuxLinux Kernel Version5.13 Updaterc4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.152
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595
Patch
https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4
Patch
https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2
Patch
https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4
Patch
https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d
Patch
https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a
Patch
https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c
Patch
https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553
Patch