CVE-2021-47577 (GCVE-0-2021-47577)
Vulnerability from cvelistv5
Published
2024-06-19 14:53
Modified
2026-08-05 08:48
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: io-wq: check for wq exit after adding new worker task_work We check IO_WQ_BIT_EXIT before attempting to create a new worker, and wq exit cancels pending work if we have any. But it's possible to have a race between the two, where creation checks exit finding it not set, but we're in the process of exiting. The exit side will cancel pending creation task_work, but there's a gap where we add task_work after we've canceled existing creations at exit time. Fix this by checking the EXIT bit post adding the creation task_work. If it's set, run the same cancelation that exit does.
References
Impacted products
Vendor Product Version
Linux Linux Version: 685fe7feedb96771683437107ba72131410e2350
Version: 685fe7feedb96771683437107ba72131410e2350
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47577",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-21T14:05:50.192086Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-21T14:06:00.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.773Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/71a85387546e50b1a37b0fa45dadcae3bfb35cf6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/io-wq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec",
              "status": "affected",
              "version": "685fe7feedb96771683437107ba72131410e2350",
              "versionType": "git"
            },
            {
              "lessThan": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
              "status": "affected",
              "version": "685fe7feedb96771683437107ba72131410e2350",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/io-wq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: check for wq exit after adding new worker task_work\n\nWe check IO_WQ_BIT_EXIT before attempting to create a new worker, and\nwq exit cancels pending work if we have any. But it\u0027s possible to have\na race between the two, where creation checks exit finding it not set,\nbut we\u0027re in the process of exiting. The exit side will cancel pending\ncreation task_work, but there\u0027s a gap where we add task_work after we\u0027ve\ncanceled existing creations at exit time.\n\nFix this by checking the EXIT bit post adding the creation task_work.\nIf it\u0027s set, run the same cancelation that exit does."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in io-wq worker creation used by io_uring and is reached only through local syscalls (io_uring_setup/io_uring_enter), not via network packet processing.\nAC:L - Although this is a race between worker creation and wq exit, the attacker controls both sides by submitting async io_uring work while concurrently exiting/closing the ring, and syzbot produced a C repro that triggers the UAF.\nPR:L - Basic io_uring_setup requires no capabilities; unprivileged local users can create rings and drive io-wq (io_uring_disabled was added years later and defaults to allowing all users).\nUI:N - Exploitation is entirely via the attacker\u0027s own io_uring syscalls and process lifecycle; no victim action is required.\nS:U - Impact stays within the host kernel authority (local memory corruption / privilege escalation / DoS), with no VM escape or other cross-boundary scope change.\nC:H - Syzbot confirmed a use-after-free write on a freed kmalloc-512 io_worker; UAF enables heap reuse and arbitrary kernel memory read primitives.\nI:H - The UAF write through freed worker create_state/task_work state can be turned into an arbitrary write and control-flow hijack via heap spraying of the reused object.\nA:H - The UAF causes kernel oops/panic under KASAN and can crash or hang the system even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:27.449Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/71a85387546e50b1a37b0fa45dadcae3bfb35cf6"
        }
      ],
      "title": "io-wq: check for wq exit after adding new worker task_work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47577",
    "datePublished": "2024-06-19T14:53:45.393Z",
    "dateReserved": "2024-05-24T15:11:00.730Z",
    "dateUpdated": "2026-08-05T08:48:27.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/71a85387546e50b1a37b0fa45dadcae3bfb35cf6\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.773Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47577\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-21T14:05:50.192086Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-21T14:05:55.882Z\"}}], \"cna\": {\"title\": \"io-wq: check for wq exit after adding new worker task_work\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in io-wq worker creation used by io_uring and is reached only through local syscalls (io_uring_setup/io_uring_enter), not via network packet processing.\\nAC:L - Although this is a race between worker creation and wq exit, the attacker controls both sides by submitting async io_uring work while concurrently exiting/closing the ring, and syzbot produced a C repro that triggers the UAF.\\nPR:L - Basic io_uring_setup requires no capabilities; unprivileged local users can create rings and drive io-wq (io_uring_disabled was added years later and defaults to allowing all users).\\nUI:N - Exploitation is entirely via the attacker\u0027s own io_uring syscalls and process lifecycle; no victim action is required.\\nS:U - Impact stays within the host kernel authority (local memory corruption / privilege escalation / DoS), with no VM escape or other cross-boundary scope change.\\nC:H - Syzbot confirmed a use-after-free write on a freed kmalloc-512 io_worker; UAF enables heap reuse and arbitrary kernel memory read primitives.\\nI:H - The UAF write through freed worker create_state/task_work state can be turned into an arbitrary write and control-flow hijack via heap spraying of the reused object.\\nA:H - The UAF causes kernel oops/panic under KASAN and can crash or hang the system even when not fully exploited for code execution.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"685fe7feedb96771683437107ba72131410e2350\", \"lessThan\": \"4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"685fe7feedb96771683437107ba72131410e2350\", \"lessThan\": \"71a85387546e50b1a37b0fa45dadcae3bfb35cf6\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/io-wq.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/io-wq.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec\"}, {\"url\": \"https://git.kernel.org/stable/c/71a85387546e50b1a37b0fa45dadcae3bfb35cf6\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio-wq: check for wq exit after adding new worker task_work\\n\\nWe check IO_WQ_BIT_EXIT before attempting to create a new worker, and\\nwq exit cancels pending work if we have any. But it\u0027s possible to have\\na race between the two, where creation checks exit finding it not set,\\nbut we\u0027re in the process of exiting. The exit side will cancel pending\\ncreation task_work, but there\u0027s a gap where we add task_work after we\u0027ve\\ncanceled existing creations at exit time.\\n\\nFix this by checking the EXIT bit post adding the creation task_work.\\nIf it\u0027s set, run the same cancelation that exit does.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.11\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:27.449Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47577\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:27.449Z\", \"dateReserved\": \"2024-05-24T15:11:00.730Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T14:53:45.393Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.