CVE-2021-47553 (GCVE-0-2021-47553)
Vulnerability from cvelistv5
Published
2024-05-24 15:09
Modified
2025-05-04 12:41
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: sched/scs: Reset task stack state in bringup_cpu() To hot unplug a CPU, the idle task on that CPU calls a few layers of C code before finally leaving the kernel. When KASAN is in use, poisoned shadow is left around for each of the active stack frames, and when shadow call stacks are in use. When shadow call stacks (SCS) are in use the task's saved SCS SP is left pointing at an arbitrary point within the task's shadow call stack. When a CPU is offlined than onlined back into the kernel, this stale state can adversely affect execution. Stale KASAN shadow can alias new stackframes and result in bogus KASAN warnings. A stale SCS SP is effectively a memory leak, and prevents a portion of the shadow call stack being used. Across a number of hotplug cycles the idle task's entire shadow call stack can become unusable. We previously fixed the KASAN issue in commit: e1b77c92981a5222 ("sched/kasan: remove stale KASAN poison after hotplug") ... by removing any stale KASAN stack poison immediately prior to onlining a CPU. Subsequently in commit: f1a0a376ca0c4ef1 ("sched/core: Initialize the idle task with preemption disabled") ... the refactoring left the KASAN and SCS cleanup in one-time idle thread initialization code rather than something invoked prior to each CPU being onlined, breaking both as above. We fixed SCS (but not KASAN) in commit: 63acd42c0d4942f7 ("sched/scs: Reset the shadow stack when idle_task_exit") ... but as this runs in the context of the idle task being offlined it's potentially fragile. To fix these consistently and more robustly, reset the SCS SP and KASAN shadow of a CPU's idle task immediately before we online that CPU in bringup_cpu(). This ensures the idle task always has a consistent state when it is running, and removes the need to so so when exiting an idle task. Whenever any thread is created, dup_task_struct() will give the task a stack which is free of KASAN shadow, and initialize the task's SCS SP, so there's no need to specially initialize either for idle thread within init_idle(), as this was only necessary to handle hotplug cycles. I've tested this on arm64 with: * gcc 11.1.0, defconfig +KASAN_INLINE, KASAN_STACK * clang 12.0.0, defconfig +KASAN_INLINE, KASAN_STACK, SHADOW_CALL_STACK ... offlining and onlining CPUS with: | while true; do | for C in /sys/devices/system/cpu/cpu*/online; do | echo 0 > $C; | echo 1 > $C; | done | done
References
Impacted products
Vendor Product Version
Linux Linux Version: 3c51d82d0b7862d7d246016c74b4390fb1fa1f11
Version: f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674
Version: f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674
Version: 1cb358b3ac1bb43aa8c4283830a84216dda65d39
Version: 24c79a7e54ccfa29fb8cbf7ed8d1e48ff1ec6e3d
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T19:56:42.885646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T19:57:05.890Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.871Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e6ee7abd6bfe559ad9989004b34c320fd638c526"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/229c555260cb9c1ccdab861e16f0410f1718f302"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/cpu.c",
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e6ee7abd6bfe559ad9989004b34c320fd638c526",
              "status": "affected",
              "version": "3c51d82d0b7862d7d246016c74b4390fb1fa1f11",
              "versionType": "git"
            },
            {
              "lessThan": "229c555260cb9c1ccdab861e16f0410f1718f302",
              "status": "affected",
              "version": "f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674",
              "versionType": "git"
            },
            {
              "lessThan": "dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3",
              "status": "affected",
              "version": "f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1cb358b3ac1bb43aa8c4283830a84216dda65d39",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "24c79a7e54ccfa29fb8cbf7ed8d1e48ff1ec6e3d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/cpu.c",
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.83",
                  "versionStartIncluding": "5.10.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.6",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.12.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/scs: Reset task stack state in bringup_cpu()\n\nTo hot unplug a CPU, the idle task on that CPU calls a few layers of C\ncode before finally leaving the kernel. When KASAN is in use, poisoned\nshadow is left around for each of the active stack frames, and when\nshadow call stacks are in use. When shadow call stacks (SCS) are in use\nthe task\u0027s saved SCS SP is left pointing at an arbitrary point within\nthe task\u0027s shadow call stack.\n\nWhen a CPU is offlined than onlined back into the kernel, this stale\nstate can adversely affect execution. Stale KASAN shadow can alias new\nstackframes and result in bogus KASAN warnings. A stale SCS SP is\neffectively a memory leak, and prevents a portion of the shadow call\nstack being used. Across a number of hotplug cycles the idle task\u0027s\nentire shadow call stack can become unusable.\n\nWe previously fixed the KASAN issue in commit:\n\n  e1b77c92981a5222 (\"sched/kasan: remove stale KASAN poison after hotplug\")\n\n... by removing any stale KASAN stack poison immediately prior to\nonlining a CPU.\n\nSubsequently in commit:\n\n  f1a0a376ca0c4ef1 (\"sched/core: Initialize the idle task with preemption disabled\")\n\n... the refactoring left the KASAN and SCS cleanup in one-time idle\nthread initialization code rather than something invoked prior to each\nCPU being onlined, breaking both as above.\n\nWe fixed SCS (but not KASAN) in commit:\n\n  63acd42c0d4942f7 (\"sched/scs: Reset the shadow stack when idle_task_exit\")\n\n... but as this runs in the context of the idle task being offlined it\u0027s\npotentially fragile.\n\nTo fix these consistently and more robustly, reset the SCS SP and KASAN\nshadow of a CPU\u0027s idle task immediately before we online that CPU in\nbringup_cpu(). This ensures the idle task always has a consistent state\nwhen it is running, and removes the need to so so when exiting an idle\ntask.\n\nWhenever any thread is created, dup_task_struct() will give the task a\nstack which is free of KASAN shadow, and initialize the task\u0027s SCS SP,\nso there\u0027s no need to specially initialize either for idle thread within\ninit_idle(), as this was only necessary to handle hotplug cycles.\n\nI\u0027ve tested this on arm64 with:\n\n* gcc 11.1.0, defconfig +KASAN_INLINE, KASAN_STACK\n* clang 12.0.0, defconfig +KASAN_INLINE, KASAN_STACK, SHADOW_CALL_STACK\n\n... offlining and onlining CPUS with:\n\n| while true; do\n|   for C in /sys/devices/system/cpu/cpu*/online; do\n|     echo 0 \u003e $C;\n|     echo 1 \u003e $C;\n|   done\n| done"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:41:41.530Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e6ee7abd6bfe559ad9989004b34c320fd638c526"
        },
        {
          "url": "https://git.kernel.org/stable/c/229c555260cb9c1ccdab861e16f0410f1718f302"
        },
        {
          "url": "https://git.kernel.org/stable/c/dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3"
        }
      ],
      "title": "sched/scs: Reset task stack state in bringup_cpu()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47553",
    "datePublished": "2024-05-24T15:09:55.961Z",
    "dateReserved": "2024-05-24T15:02:54.833Z",
    "dateUpdated": "2025-05-04T12:41:41.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e6ee7abd6bfe559ad9989004b34c320fd638c526\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/229c555260cb9c1ccdab861e16f0410f1718f302\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.871Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47553\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T19:56:42.885646Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T19:57:00.241Z\"}}], \"cna\": {\"title\": \"sched/scs: Reset task stack state in bringup_cpu()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3c51d82d0b7862d7d246016c74b4390fb1fa1f11\", \"lessThan\": \"e6ee7abd6bfe559ad9989004b34c320fd638c526\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674\", \"lessThan\": \"229c555260cb9c1ccdab861e16f0410f1718f302\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674\", \"lessThan\": \"dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cb358b3ac1bb43aa8c4283830a84216dda65d39\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"24c79a7e54ccfa29fb8cbf7ed8d1e48ff1ec6e3d\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/cpu.c\", \"kernel/sched/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/cpu.c\", \"kernel/sched/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e6ee7abd6bfe559ad9989004b34c320fd638c526\"}, {\"url\": \"https://git.kernel.org/stable/c/229c555260cb9c1ccdab861e16f0410f1718f302\"}, {\"url\": \"https://git.kernel.org/stable/c/dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched/scs: Reset task stack state in bringup_cpu()\\n\\nTo hot unplug a CPU, the idle task on that CPU calls a few layers of C\\ncode before finally leaving the kernel. When KASAN is in use, poisoned\\nshadow is left around for each of the active stack frames, and when\\nshadow call stacks are in use. When shadow call stacks (SCS) are in use\\nthe task\u0027s saved SCS SP is left pointing at an arbitrary point within\\nthe task\u0027s shadow call stack.\\n\\nWhen a CPU is offlined than onlined back into the kernel, this stale\\nstate can adversely affect execution. Stale KASAN shadow can alias new\\nstackframes and result in bogus KASAN warnings. A stale SCS SP is\\neffectively a memory leak, and prevents a portion of the shadow call\\nstack being used. Across a number of hotplug cycles the idle task\u0027s\\nentire shadow call stack can become unusable.\\n\\nWe previously fixed the KASAN issue in commit:\\n\\n  e1b77c92981a5222 (\\\"sched/kasan: remove stale KASAN poison after hotplug\\\")\\n\\n... by removing any stale KASAN stack poison immediately prior to\\nonlining a CPU.\\n\\nSubsequently in commit:\\n\\n  f1a0a376ca0c4ef1 (\\\"sched/core: Initialize the idle task with preemption disabled\\\")\\n\\n... the refactoring left the KASAN and SCS cleanup in one-time idle\\nthread initialization code rather than something invoked prior to each\\nCPU being onlined, breaking both as above.\\n\\nWe fixed SCS (but not KASAN) in commit:\\n\\n  63acd42c0d4942f7 (\\\"sched/scs: Reset the shadow stack when idle_task_exit\\\")\\n\\n... but as this runs in the context of the idle task being offlined it\u0027s\\npotentially fragile.\\n\\nTo fix these consistently and more robustly, reset the SCS SP and KASAN\\nshadow of a CPU\u0027s idle task immediately before we online that CPU in\\nbringup_cpu(). This ensures the idle task always has a consistent state\\nwhen it is running, and removes the need to so so when exiting an idle\\ntask.\\n\\nWhenever any thread is created, dup_task_struct() will give the task a\\nstack which is free of KASAN shadow, and initialize the task\u0027s SCS SP,\\nso there\u0027s no need to specially initialize either for idle thread within\\ninit_idle(), as this was only necessary to handle hotplug cycles.\\n\\nI\u0027ve tested this on arm64 with:\\n\\n* gcc 11.1.0, defconfig +KASAN_INLINE, KASAN_STACK\\n* clang 12.0.0, defconfig +KASAN_INLINE, KASAN_STACK, SHADOW_CALL_STACK\\n\\n... offlining and onlining CPUS with:\\n\\n| while true; do\\n|   for C in /sys/devices/system/cpu/cpu*/online; do\\n|     echo 0 \u003e $C;\\n|     echo 1 \u003e $C;\\n|   done\\n| done\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.83\", \"versionStartIncluding\": \"5.10.50\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.6\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.12.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.13.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T12:41:41.530Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47553\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T12:41:41.530Z\", \"dateReserved\": \"2024-05-24T15:02:54.833Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-24T15:09:55.961Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.