{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47488", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-22T06:20:56.201Z", "datePublished": "2024-05-22T08:19:38.117Z", "dateUpdated": "2024-11-04T12:06:53.179Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:06:53.179Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Fix memory leak caused by missing cgroup_bpf_offline\n\nWhen enabling CONFIG_CGROUP_BPF, kmemleak can be observed by running\nthe command as below:\n\n $mount -t cgroup -o none,name=foo cgroup cgroup/\n $umount cgroup/\n\nunreferenced object 0xc3585c40 (size 64):\n comm \"mount\", pid 425, jiffies 4294959825 (age 31.990s)\n hex dump (first 32 bytes):\n 01 00 00 80 84 8c 28 c0 00 00 00 00 00 00 00 00 ......(.........\n 00 00 00 00 00 00 00 00 6c 43 a0 c3 00 00 00 00 ........lC......\n backtrace:\n [<e95a2f9e>] cgroup_bpf_inherit+0x44/0x24c\n [<1f03679c>] cgroup_setup_root+0x174/0x37c\n [<ed4b0ac5>] cgroup1_get_tree+0x2c0/0x4a0\n [<f85b12fd>] vfs_get_tree+0x24/0x108\n [<f55aec5c>] path_mount+0x384/0x988\n [<e2d5e9cd>] do_mount+0x64/0x9c\n [<208c9cfe>] sys_mount+0xfc/0x1f4\n [<06dd06e0>] ret_fast_syscall+0x0/0x48\n [<a8308cb3>] 0xbeb4daa8\n\nThis is because that since the commit 2b0d3d3e4fcf (\"percpu_ref: reduce\nmemory footprint of percpu_ref in fast path\") root_cgrp->bpf.refcnt.data\nis allocated by the function percpu_ref_init in cgroup_bpf_inherit which\nis called by cgroup_setup_root when mounting, but not freed along with\nroot_cgrp when umounting. Adding cgroup_bpf_offline which calls\npercpu_ref_kill to cgroup_kill_sb can free root_cgrp->bpf.refcnt.data in\numount path.\n\nThis patch also fixes the commit 4bfc0bb2c60e (\"bpf: decouple the lifetime\nof cgroup_bpf from cgroup itself\"). A cgroup_bpf_offline is needed to do a\ncleanup that frees the resources which are allocated by cgroup_bpf_inherit\nin cgroup_setup_root.\n\nAnd inside cgroup_bpf_offline, cgroup_get() is at the beginning and\ncgroup_put is at the end of cgroup_bpf_release which is called by\ncgroup_bpf_offline. So cgroup_bpf_offline can keep the balance of\ncgroup's refcount."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/cgroup/cgroup.c"], "versions": [{"version": "4bfc0bb2c60e", "lessThan": "01599bf7cc2b", "status": "affected", "versionType": "git"}, {"version": "4bfc0bb2c60e", "lessThan": "b529f88d9388", "status": "affected", "versionType": "git"}, {"version": "4bfc0bb2c60e", "lessThan": "04f8ef5643bc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/cgroup/cgroup.c"], "versions": [{"version": "5.3", "status": "affected"}, {"version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.77", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.14.16", "lessThanOrEqual": "5.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/01599bf7cc2b49c3d2be886cb438647dc25446ed"}, {"url": "https://git.kernel.org/stable/c/b529f88d93884cf8ccafda793ee3d27b82fa578d"}, {"url": "https://git.kernel.org/stable/c/04f8ef5643bcd8bcde25dfdebef998aea480b2ba"}], "title": "cgroup: Fix memory leak caused by missing cgroup_bpf_offline", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.588Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/01599bf7cc2b49c3d2be886cb438647dc25446ed", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b529f88d93884cf8ccafda793ee3d27b82fa578d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/04f8ef5643bcd8bcde25dfdebef998aea480b2ba", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47488", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:35:55.494242Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:32:53.086Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/01599bf7cc2b49c3d2be886cb438647dc25446ed", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b529f88d93884cf8ccafda793ee3d27b82fa578d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/04f8ef5643bcd8bcde25dfdebef998aea480b2ba", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.588Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47488", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:35:55.494242Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:13.234Z"}}], "cna": {"title": "cgroup: Fix memory leak caused by missing cgroup_bpf_offline", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4bfc0bb2c60e", "lessThan": "01599bf7cc2b", "versionType": "git"}, {"status": "affected", "version": "4bfc0bb2c60e", "lessThan": "b529f88d9388", "versionType": "git"}, {"status": "affected", "version": "4bfc0bb2c60e", "lessThan": "04f8ef5643bc", "versionType": "git"}], "programFiles": ["kernel/cgroup/cgroup.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"status": "unaffected", "version": "0", "lessThan": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.77", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.14.16", "versionType": "semver", "lessThanOrEqual": "5.14.*"}, {"status": "unaffected", "version": "5.15", "versionType": "semver", "lessThanOrEqual": "*"}], "programFiles": ["kernel/cgroup/cgroup.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/01599bf7cc2b49c3d2be886cb438647dc25446ed"}, {"url": "https://git.kernel.org/stable/c/b529f88d93884cf8ccafda793ee3d27b82fa578d"}, {"url": "https://git.kernel.org/stable/c/04f8ef5643bcd8bcde25dfdebef998aea480b2ba"}], "x_generator": {"engine": "bippy-c8e10e5f6187"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Fix memory leak caused by missing cgroup_bpf_offline\n\nWhen enabling CONFIG_CGROUP_BPF, kmemleak can be observed by running\nthe command as below:\n\n $mount -t cgroup -o none,name=foo cgroup cgroup/\n $umount cgroup/\n\nunreferenced object 0xc3585c40 (size 64):\n comm \"mount\", pid 425, jiffies 4294959825 (age 31.990s)\n hex dump (first 32 bytes):\n 01 00 00 80 84 8c 28 c0 00 00 00 00 00 00 00 00 ......(.........\n 00 00 00 00 00 00 00 00 6c 43 a0 c3 00 00 00 00 ........lC......\n backtrace:\n [<e95a2f9e>] cgroup_bpf_inherit+0x44/0x24c\n [<1f03679c>] cgroup_setup_root+0x174/0x37c\n [<ed4b0ac5>] cgroup1_get_tree+0x2c0/0x4a0\n [<f85b12fd>] vfs_get_tree+0x24/0x108\n [<f55aec5c>] path_mount+0x384/0x988\n [<e2d5e9cd>] do_mount+0x64/0x9c\n [<208c9cfe>] sys_mount+0xfc/0x1f4\n [<06dd06e0>] ret_fast_syscall+0x0/0x48\n [<a8308cb3>] 0xbeb4daa8\n\nThis is because that since the commit 2b0d3d3e4fcf (\"percpu_ref: reduce\nmemory footprint of percpu_ref in fast path\") root_cgrp->bpf.refcnt.data\nis allocated by the function percpu_ref_init in cgroup_bpf_inherit which\nis called by cgroup_setup_root when mounting, but not freed along with\nroot_cgrp when umounting. Adding cgroup_bpf_offline which calls\npercpu_ref_kill to cgroup_kill_sb can free root_cgrp->bpf.refcnt.data in\numount path.\n\nThis patch also fixes the commit 4bfc0bb2c60e (\"bpf: decouple the lifetime\nof cgroup_bpf from cgroup itself\"). A cgroup_bpf_offline is needed to do a\ncleanup that frees the resources which are allocated by cgroup_bpf_inherit\nin cgroup_setup_root.\n\nAnd inside cgroup_bpf_offline, cgroup_get() is at the beginning and\ncgroup_put is at the end of cgroup_bpf_release which is called by\ncgroup_bpf_offline. So cgroup_bpf_offline can keep the balance of\ncgroup's refcount."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:42:15.643Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47488", "state": "PUBLISHED", "dateUpdated": "2024-11-04T11:42:15.643Z", "dateReserved": "2024-05-22T06:20:56.201Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-22T08:19:38.117Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Fix memory leak caused by missing cgroup_bpf_offline\n\nWhen enabling CONFIG_CGROUP_BPF, kmemleak can be observed by running\nthe command as below:\n\n $mount -t cgroup -o none,name=foo cgroup cgroup/\n $umount cgroup/\n\nunreferenced object 0xc3585c40 (size 64):\n comm \"mount\", pid 425, jiffies 4294959825 (age 31.990s)\n hex dump (first 32 bytes):\n 01 00 00 80 84 8c 28 c0 00 00 00 00 00 00 00 00 ......(.........\n 00 00 00 00 00 00 00 00 6c 43 a0 c3 00 00 00 00 ........lC......\n backtrace:\n [<e95a2f9e>] cgroup_bpf_inherit+0x44/0x24c\n [<1f03679c>] cgroup_setup_root+0x174/0x37c\n [<ed4b0ac5>] cgroup1_get_tree+0x2c0/0x4a0\n [<f85b12fd>] vfs_get_tree+0x24/0x108\n [<f55aec5c>] path_mount+0x384/0x988\n [<e2d5e9cd>] do_mount+0x64/0x9c\n [<208c9cfe>] sys_mount+0xfc/0x1f4\n [<06dd06e0>] ret_fast_syscall+0x0/0x48\n [<a8308cb3>] 0xbeb4daa8\n\nThis is because that since the commit 2b0d3d3e4fcf (\"percpu_ref: reduce\nmemory footprint of percpu_ref in fast path\") root_cgrp->bpf.refcnt.data\nis allocated by the function percpu_ref_init in cgroup_bpf_inherit which\nis called by cgroup_setup_root when mounting, but not freed along with\nroot_cgrp when umounting. Adding cgroup_bpf_offline which calls\npercpu_ref_kill to cgroup_kill_sb can free root_cgrp->bpf.refcnt.data in\numount path.\n\nThis patch also fixes the commit 4bfc0bb2c60e (\"bpf: decouple the lifetime\nof cgroup_bpf from cgroup itself\"). A cgroup_bpf_offline is needed to do a\ncleanup that frees the resources which are allocated by cgroup_bpf_inherit\nin cgroup_setup_root.\n\nAnd inside cgroup_bpf_offline, cgroup_get() is at the beginning and\ncgroup_put is at the end of cgroup_bpf_release which is called by\ncgroup_bpf_offline. So cgroup_bpf_offline can keep the balance of\ncgroup's refcount."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: cgroup: corrige la p\u00e9rdida de memoria causada por la falta de cgroup_bpf_offline Al habilitar CONFIG_CGROUP_BPF, se puede observar kmemleak ejecutando el siguiente comando: $mount -t cgroup -o none,name=foo cgroup cgroup / $umount cgroup/ objeto sin referencia 0xc3585c40 (tama\u00f1o 64): comm \"mount\", pid 425, sjiffies 4294959825 (edad 31.990s) volcado hexadecimal (primeros 32 bytes): 01 00 00 80 84 8c 28 c0 00 00 00 00 00 00 00 00 ......(....... 00 00 00 00 00 00 00 00 6c 43 a0 c3 00 00 00 00 ........lC...... retroceso : [] cgroup_bpf_inherit+0x44/0x24c [&lt;1f03679c&gt;] cgroup_setup_root+0x174/0x37c [] cgroup1_get_tree+0x2c0/0x4a0 [] 8 [] ruta_montaje+0x384/ 0x988 [] do_mount+0x64/0x9c [&lt;208c9cfe&gt;] sys_mount+0xfc/0x1f4 [&lt;06dd06e0&gt;] ret_fast_syscall+0x0/0x48 [] 0xbeb4daa8 Esto se debe a que desde El commit 2b0d3d3e4f cf (\"percpu_ref: reducir huella de memoria de percpu_ref en la ruta r\u00e1pida\") root_cgrp-&gt;bpf.refcnt.data es asignada por la funci\u00f3n percpu_ref_init en cgroup_bpf_inherit, que es llamada por cgroup_setup_root al montar, pero no se libera junto con root_cgrp al desmontar. Agregar cgroup_bpf_offline que llama a percpu_ref_kill a cgroup_kill_sb puede liberar root_cgrp-&gt;bpf.refcnt.data en la ruta de montaje. Este parche tambi\u00e9n corrige el commit 4bfc0bb2c60e (\"bpf: desacople la vida \u00fatil de cgroup_bpf del propio cgroup\"). Se necesita cgroup_bpf_offline para realizar una sanitizaci\u00f3n que libere los recursos asignados por cgroup_bpf_inherit en cgroup_setup_root. Y dentro de cgroup_bpf_offline, cgroup_get() est\u00e1 al principio y cgroup_put est\u00e1 al final de cgroup_bpf_release, que es llamado por cgroup_bpf_offline. Entonces cgroup_bpf_offline puede mantener el saldo del recuento de cgroup."}], "id": "CVE-2021-47488", "lastModified": "2024-05-22T12:46:53.887", "metrics": {}, "published": "2024-05-22T09:15:10.700", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/01599bf7cc2b49c3d2be886cb438647dc25446ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/04f8ef5643bcd8bcde25dfdebef998aea480b2ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b529f88d93884cf8ccafda793ee3d27b82fa578d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: cgroup: Fix memory leak caused by missing cgroup_bpf_offline", "id": "2282929", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282929"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-404", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncgroup: Fix memory leak caused by missing cgroup_bpf_offline\nWhen enabling CONFIG_CGROUP_BPF, kmemleak can be observed by running\nthe command as below:\n$mount -t cgroup -o none,name=foo cgroup cgroup/\n$umount cgroup/\nunreferenced object 0xc3585c40 (size 64):\ncomm \"mount\", pid 425, jiffies 4294959825 (age 31.990s)\nhex dump (first 32 bytes):\n01 00 00 80 84 8c 28 c0 00 00 00 00 00 00 00 00 ......(.........\n00 00 00 00 00 00 00 00 6c 43 a0 c3 00 00 00 00 ........lC......\nbacktrace:\n[<e95a2f9e>] cgroup_bpf_inherit+0x44/0x24c\n[<1f03679c>] cgroup_setup_root+0x174/0x37c\n[<ed4b0ac5>] cgroup1_get_tree+0x2c0/0x4a0\n[<f85b12fd>] vfs_get_tree+0x24/0x108\n[<f55aec5c>] path_mount+0x384/0x988\n[<e2d5e9cd>] do_mount+0x64/0x9c\n[<208c9cfe>] sys_mount+0xfc/0x1f4\n[<06dd06e0>] ret_fast_syscall+0x0/0x48\n[<a8308cb3>] 0xbeb4daa8\nThis is because that since the commit 2b0d3d3e4fcf (\"percpu_ref: reduce\nmemory footprint of percpu_ref in fast path\") root_cgrp->bpf.refcnt.data\nis allocated by the function percpu_ref_init in cgroup_bpf_inherit which\nis called by cgroup_setup_root when mounting, but not freed along with\nroot_cgrp when umounting. Adding cgroup_bpf_offline which calls\npercpu_ref_kill to cgroup_kill_sb can free root_cgrp->bpf.refcnt.data in\numount path.\nThis patch also fixes the commit 4bfc0bb2c60e (\"bpf: decouple the lifetime\nof cgroup_bpf from cgroup itself\"). A cgroup_bpf_offline is needed to do a\ncleanup that frees the resources which are allocated by cgroup_bpf_inherit\nin cgroup_setup_root.\nAnd inside cgroup_bpf_offline, cgroup_get() is at the beginning and\ncgroup_put is at the end of cgroup_bpf_release which is called by\ncgroup_bpf_offline. So cgroup_bpf_offline can keep the balance of\ncgroup's refcount."], "name": "CVE-2021-47488", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47488\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47488\nhttps://lore.kernel.org/linux-cve-announce/2024052240-CVE-2021-47488-9c35@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 5.10.77, kernel 5.14.16, kernel 5.15"}