CVE-2021-47304 Affecting kernel-rt-debug-core package, versions <0:4.18.0-553.16.1.rt7.357.el8_10
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ALMALINUX8-KERNELRTDEBUGCORE-7658215
- published9 Aug 2024
- disclosed8 Aug 2024
Introduced: 8 Aug 2024
CVE-2021-47304 (opens in a new tab)How to fix?
Upgrade AlmaLinux:8 kernel-rt-debug-core to version 0:4.18.0-553.16.1.rt7.357.el8_10 or higher.
This issue was patched in ALSA-2024:5102.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-rt-debug-core package and not the kernel-rt-debug-core package as distributed by AlmaLinux.
See How to fix? for AlmaLinux:8 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized
This commit fixes a bug (found by syzkaller) that could cause spurious double-initializations for congestion control modules, which could cause memory leaks or other problems for congestion control modules (like CDG) that allocate memory in their init functions.
The buggy scenario constructed by syzkaller was something like:
(1) create a TCP socket (2) initiate a TFO connect via sendto() (3) while socket is in TCP_SYN_SENT, call setsockopt(TCP_CONGESTION), which calls: tcp_set_congestion_control() -> tcp_reinit_congestion_control() -> tcp_init_congestion_control() (4) receive ACK, connection is established, call tcp_init_transfer(), set icsk_ca_initialized=0 (without first calling cc->release()), call tcp_init_congestion_control() again.
Note that in this sequence tcp_init_congestion_control() is called twice without a cc->release() call in between. Thus, for CC modules that allocate memory in their init() function, e.g, CDG, a memory leak may occur. The syzkaller tool managed to find a reproducer that triggered such a leak in CDG.
The bug was introduced when that commit 8919a9b31eb4 ("tcp: Only init congestion control if not initialized already") introduced icsk_ca_initialized and set icsk_ca_initialized to 0 in tcp_init_transfer(), missing the possibility for a sequence like the one above, where a process could call setsockopt(TCP_CONGESTION) in state TCP_SYN_SENT (i.e. after the connect() or TFO open sendmsg()), which would call tcp_init_congestion_control(). It did not intend to reset any initialization that the user had already explicitly made; it just missed the possibility of that particular sequence (which syzkaller managed to find).
References
- https://errata.almalinux.org/8/ALSA-2024-5101.html
- https://errata.almalinux.org/8/ALSA-2024-5102.html
- https://access.redhat.com/security/cve/CVE-2021-47304
- https://access.redhat.com/errata/RHSA-2024:5101
- https://access.redhat.com/errata/RHSA-2024:5102
- https://git.kernel.org/stable/c/ad4ba3404931745a5977ad12db4f0c34080e52f7
- https://git.kernel.org/stable/c/be5d1b61a2ad28c7e57fe8bfa277373e8ecffcdc
- https://git.kernel.org/stable/c/fe77b85828ca9ddc42977b79de9e40d18545b4fe