Resource Injection The advisory has been revoked - it doesn't affect any version of package rv  (opens in a new tab)

The Centos security team deemed this advisory irrelevant for Centos:9.

Note: Versions mentioned in the description apply only to the upstream rv package and not the rv package as distributed by Centos.

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: actually fix freelist pointer vs redzoning

It turns out that SLUB redzoning ("slub_debug=Z") checks from s->object_size rather than from s->inuse (which is normally bumped to make room for the freelist pointer), so a cache created with an object size less than 24 would have the freelist pointer written beyond s->object_size, causing the redzone to be corrupted by the freelist pointer. This was very visible with "slub_debug=ZF":

BUG test (Tainted: G B ): Right Redzone overwritten

INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200 INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620

Redzone (ptrval): bb bb bb bb bb bb bb bb ........ Object (ptrval): 00 00 00 00 00 f6 f4 a5 ........ Redzone (ptrval): 40 1d e8 1a aa @.... Padding (ptrval): 00 00 00 00 00 00 00 00 ........

Adjust the offset to stay within s->object_size.

(Note that no caches of in this size range are known to exist in the kernel currently.)

• https://access.redhat.com/security/cve/CVE-2021-47221
• https://git.kernel.org/stable/c/ce6e8bee7a3883e8008b30f5887dbb426aac6a35
• https://git.kernel.org/stable/c/e41a49fadbc80b60b48d3c095d9e2ee7ef7c9a8e
• https://git.kernel.org/stable/c/f6ed2357541612a13a5841b3af4dc32ed984a25f