CVE-2021-46921

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-46921", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-25T13:45:52.719Z", "datePublished": "2024-02-27T09:36:26.461Z", "dateUpdated": "2026-08-05T08:45:05.258Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:05.258Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\n\nWhile this code is executed with the wait_lock held, a reader can\nacquire the lock without holding wait_lock. The writer side loops\nchecking the value with the atomic_cond_read_acquire(), but only truly\nacquires the lock when the compare-and-exchange is completed\nsuccessfully which isn\u2019t ordered. This exposes the window between the\nacquire and the cmpxchg to an A-B-A problem which allows reads\nfollowing the lock acquisition to observe values speculatively before\nthe write lock is truly acquired.\n\nWe've seen a problem in epoll where the reader does a xchg while\nholding the read lock, but the writer can see a value change out from\nunder it.\n\n Writer | Reader\n --------------------------------------------------------------------------------\n ep_scan_ready_list() |\n |- write_lock_irq() |\n |- queued_write_lock_slowpath() |\n\t|- atomic_cond_read_acquire() |\n\t\t\t\t | read_lock_irqsave(&ep->lock, flags);\n --> (observes value before unlock) | chain_epi_lockless()\n | | epi->next = xchg(&ep->ovflist, epi);\n | | read_unlock_irqrestore(&ep->lock, flags);\n | |\n | atomic_cmpxchg_relaxed() |\n |-- READ_ONCE(ep->ovflist); |\n\nA core can order the read of the ovflist ahead of the\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\nsemantics addresses this issue at which point the atomic_cond_read can\nbe switched to use relaxed semantics.\n\n[peterz: use try_cmpxchg()]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in queued_write_lock_slowpath() for rwlock_t; the demonstrated path is local epoll_wait \u2192 ep_send_events \u2192 ep_done_scan \u2192 write_lock_irq(), which requires local syscall access rather than network or physical reachability.\nAC:L - An unprivileged attacker can drive both sides of the race (epoll_wait as writer and concurrent fd events triggering ep_poll_callback as reader), forcing lock contention into the slowpath; Amazon observed this ordering failure in production on ARM, so success is not dependent on victim-controlled conditions.\nPR:L - epoll_create/epoll_ctl/epoll_wait and ordinary process activity that take rwlocks are available to unprivileged local users with no capabilities or user-namespace privilege escalation required.\nUI:N - Exploitation requires only attacker-controlled threads and file descriptors; no separate victim action such as mounting a filesystem or opening a crafted file is needed.\nS:U - Impact remains within the host kernel's privilege boundary (incorrect mutual exclusion and resulting memory/state corruption), with no VM-escape or other cross-authority scope change.\nC:H - Missing acquire semantics let a writer observe shared kernel state before the write lock is truly held, so protected structures (e.g. ep->ovflist and any other rwlock-guarded data) can be read incorrectly; as a generic rwlock break this enables broad kernel info disclosure via corrupted/racy structure access.\nI:H - The writer then mutates state based on that stale view (e.g. ep_done_scan writing EP_UNACTIVE_PTR over an overflow chain it missed), and broken write-lock exclusivity on widely used rwlocks such as tasklist_lock can corrupt kernel pointer-rich structures, enabling integrity loss and control-flow primitives.\nA:H - Data races from broken qrwlock acquire on structures protected by rwlock_t (epoll lists, tasklist, and others on ARM64/Android) can yield list corruption, use-after-free, and kernel oops/panic under attacker-triggered contention."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/locking/qrwlock.c"], "versions": [{"version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "lessThan": "5902f9453a313be8fe78cbd7e7ca9dba9319fc6e", "status": "affected", "versionType": "git"}, {"version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "lessThan": "82808cc026811fbc3ecf0c0b267a12a339eead56", "status": "affected", "versionType": "git"}, {"version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "lessThan": "82fa9ced35d88581cffa4a1c856fc41fca96d80a", "status": "affected", "versionType": "git"}, {"version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "lessThan": "d558fcdb17139728347bccc60a16af3e639649d2", "status": "affected", "versionType": "git"}, {"version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "lessThan": "84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/locking/qrwlock.c"], "versions": [{"version": "4.15", "status": "affected"}, {"version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.189", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.115", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.33", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.11.17", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "4.19.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.4.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.10.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.11.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e"}, {"url": "https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56"}, {"url": "https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a"}, {"url": "https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2"}, {"url": "https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896"}], "title": "locking/qrwlock: Fix ordering in queued_write_lock_slowpath()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46921", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-27T16:11:46.310286Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:22:01.427Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:42.848Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:42.848Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46921", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-27T16:11:46.310286Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:40.966Z"}}], "cna": {"title": "locking/qrwlock: Fix ordering in queued_write_lock_slowpath()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in queued_write_lock_slowpath() for rwlock_t; the demonstrated path is local epoll_wait \u2192 ep_send_events \u2192 ep_done_scan \u2192 write_lock_irq(), which requires local syscall access rather than network or physical reachability.\nAC:L - An unprivileged attacker can drive both sides of the race (epoll_wait as writer and concurrent fd events triggering ep_poll_callback as reader), forcing lock contention into the slowpath; Amazon observed this ordering failure in production on ARM, so success is not dependent on victim-controlled conditions.\nPR:L - epoll_create/epoll_ctl/epoll_wait and ordinary process activity that take rwlocks are available to unprivileged local users with no capabilities or user-namespace privilege escalation required.\nUI:N - Exploitation requires only attacker-controlled threads and file descriptors; no separate victim action such as mounting a filesystem or opening a crafted file is needed.\nS:U - Impact remains within the host kernel's privilege boundary (incorrect mutual exclusion and resulting memory/state corruption), with no VM-escape or other cross-authority scope change.\nC:H - Missing acquire semantics let a writer observe shared kernel state before the write lock is truly held, so protected structures (e.g. ep->ovflist and any other rwlock-guarded data) can be read incorrectly; as a generic rwlock break this enables broad kernel info disclosure via corrupted/racy structure access.\nI:H - The writer then mutates state based on that stale view (e.g. ep_done_scan writing EP_UNACTIVE_PTR over an overflow chain it missed), and broken write-lock exclusivity on widely used rwlocks such as tasklist_lock can corrupt kernel pointer-rich structures, enabling integrity loss and control-flow primitives.\nA:H - Data races from broken qrwlock acquire on structures protected by rwlock_t (epoll lists, tasklist, and others on ARM64/Android) can yield list corruption, use-after-free, and kernel oops/panic under attacker-triggered contention."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "lessThan": "5902f9453a313be8fe78cbd7e7ca9dba9319fc6e", "versionType": "git"}, {"status": "affected", "version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "lessThan": "82808cc026811fbc3ecf0c0b267a12a339eead56", "versionType": "git"}, {"status": "affected", "version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "lessThan": "82fa9ced35d88581cffa4a1c856fc41fca96d80a", "versionType": "git"}, {"status": "affected", "version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "lessThan": "d558fcdb17139728347bccc60a16af3e639649d2", "versionType": "git"}, {"status": "affected", "version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "lessThan": "84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896", "versionType": "git"}], "programFiles": ["kernel/locking/qrwlock.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"status": "unaffected", "version": "0", "lessThan": "4.15", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.189", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.115", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.33", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.11.17", "versionType": "semver", "lessThanOrEqual": "5.11.*"}, {"status": "unaffected", "version": "5.12", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/locking/qrwlock.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e"}, {"url": "https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56"}, {"url": "https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a"}, {"url": "https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2"}, {"url": "https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\n\nWhile this code is executed with the wait_lock held, a reader can\nacquire the lock without holding wait_lock. The writer side loops\nchecking the value with the atomic_cond_read_acquire(), but only truly\nacquires the lock when the compare-and-exchange is completed\nsuccessfully which isn\u2019t ordered. This exposes the window between the\nacquire and the cmpxchg to an A-B-A problem which allows reads\nfollowing the lock acquisition to observe values speculatively before\nthe write lock is truly acquired.\n\nWe've seen a problem in epoll where the reader does a xchg while\nholding the read lock, but the writer can see a value change out from\nunder it.\n\n Writer | Reader\n --------------------------------------------------------------------------------\n ep_scan_ready_list() |\n |- write_lock_irq() |\n |- queued_write_lock_slowpath() |\n\t|- atomic_cond_read_acquire() |\n\t\t\t\t | read_lock_irqsave(&ep->lock, flags);\n --> (observes value before unlock) | chain_epi_lockless()\n | | epi->next = xchg(&ep->ovflist, epi);\n | | read_unlock_irqrestore(&ep->lock, flags);\n | |\n | atomic_cmpxchg_relaxed() |\n |-- READ_ONCE(ep->ovflist); |\n\nA core can order the read of the ovflist ahead of the\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\nsemantics addresses this issue at which point the atomic_cond_read can\nbe switched to use relaxed semantics.\n\n[peterz: use try_cmpxchg()]"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.189", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.115", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.33", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.11.17", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.12", "versionStartIncluding": "4.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:05.258Z"}}}, "cveMetadata": {"cveId": "CVE-2021-46921", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:45:05.258Z", "dateReserved": "2024-02-25T13:45:52.719Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-27T09:36:26.461Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/locking/qrwlock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5902f9453a313be8fe78cbd7e7ca9dba9319fc6e", "status": "affected", "version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "versionType": "git"}, {"lessThan": "82808cc026811fbc3ecf0c0b267a12a339eead56", "status": "affected", "version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "versionType": "git"}, {"lessThan": "82fa9ced35d88581cffa4a1c856fc41fca96d80a", "status": "affected", "version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "versionType": "git"}, {"lessThan": "d558fcdb17139728347bccc60a16af3e639649d2", "status": "affected", "version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "versionType": "git"}, {"lessThan": "84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896", "status": "affected", "version": "b519b56e378ee82caf9b079b04f5db87dedc3251", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/locking/qrwlock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.189", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.115", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.33", "versionType": "semver"}, {"lessThanOrEqual": "5.11.*", "status": "unaffected", "version": "5.11.17", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.12", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8EEE5714-B0F5-40FB-9A6E-4BF3F2A51B2E", "versionEndExcluding": "4.19.189", "versionStartIncluding": "4.15.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC57D065-3933-4083-BA07-817D4CBF8157", "versionEndExcluding": "5.4.115", "versionStartIncluding": "4.20.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "995EF7FE-8C8F-470B-8214-BC0C68B162C3", "versionEndExcluding": "5.10.33", "versionStartIncluding": "5.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C74925C-5E45-4C6F-9E47-653DC5ACBE9E", "versionEndExcluding": "5.11.17", "versionStartIncluding": "5.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\n\nWhile this code is executed with the wait_lock held, a reader can\nacquire the lock without holding wait_lock. The writer side loops\nchecking the value with the atomic_cond_read_acquire(), but only truly\nacquires the lock when the compare-and-exchange is completed\nsuccessfully which isn\u2019t ordered. This exposes the window between the\nacquire and the cmpxchg to an A-B-A problem which allows reads\nfollowing the lock acquisition to observe values speculatively before\nthe write lock is truly acquired.\n\nWe've seen a problem in epoll where the reader does a xchg while\nholding the read lock, but the writer can see a value change out from\nunder it.\n\n Writer | Reader\n --------------------------------------------------------------------------------\n ep_scan_ready_list() |\n |- write_lock_irq() |\n |- queued_write_lock_slowpath() |\n\t|- atomic_cond_read_acquire() |\n\t\t\t\t | read_lock_irqsave(&ep->lock, flags);\n --> (observes value before unlock) | chain_epi_lockless()\n | | epi->next = xchg(&ep->ovflist, epi);\n | | read_unlock_irqrestore(&ep->lock, flags);\n | |\n | atomic_cmpxchg_relaxed() |\n |-- READ_ONCE(ep->ovflist); |\n\nA core can order the read of the ovflist ahead of the\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\nsemantics addresses this issue at which point the atomic_cond_read can\nbe switched to use relaxed semantics.\n\n[peterz: use try_cmpxchg()]"}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: lock/qrwlock: corrige el orden en queued_write_lock_slowpath() Mientras este c\u00f3digo se ejecuta con wait_lock retenido, un lector puede adquirir el bloqueo sin mantener wait_lock. El lado del escritor realiza un bucle para verificar el valor con atomic_cond_read_acquire(), pero solo adquiere realmente el bloqueo cuando la comparaci\u00f3n e intercambio se completa con \u00e9xito, lo cual no est\u00e1 ordenado. Esto expone la ventana entre la adquisici\u00f3n y el cmpxchg a un problema ABA que permite que las lecturas posteriores a la adquisici\u00f3n del bloqueo observen los valores de forma especulativa antes de que se adquiera realmente el bloqueo de escritura. Hemos visto un problema en epoll donde el lector realiza un xchg mientras mantiene el bloqueo de lectura, pero el escritor puede ver un cambio de valor debajo de \u00e9l. Escritor | Lector ------------------------------------------------- ------------------------------- ep_scan_ready_list() | |- write_lock_irq() | |- queued_write_lock_slowpath() | |- atomic_cond_read_acquire() | | read_lock_irqsave(&ep->bloquear, banderas); --> (observa el valor antes de desbloquear) | cadena_epi_lockless() | | epi->siguiente = xchg(&ep->ovflist, epi); | | read_unlock_irqrestore(&ep->bloquear, banderas); | | | atomic_cmpxchg_relaxed() | |-- READ_ONCE(ep->ovflist); | Un n\u00facleo puede ordenar la lectura de ovflist antes de atomic_cmpxchg_relaxed(). Cambiar cmpxchg para usar la sem\u00e1ntica de adquisici\u00f3n soluciona este problema, momento en el que atomic_cond_read se puede cambiar para usar una sem\u00e1ntica relajada. [peterz: utilice try_cmpxchg()]"}], "id": "CVE-2021-46921", "lastModified": "2026-08-04T10:16:36.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-46921", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-02-27T16:11:46.310286Z", "version": "2.0.3"}}]}, "published": "2024-02-27T10:15:06.990", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: locking/qrwlock: Fix ordering in queued_write_lock_slowpath()", "id": "2266440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2266440"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-402", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\nWhile this code is executed with the wait_lock held, a reader can\nacquire the lock without holding wait_lock. The writer side loops\nchecking the value with the atomic_cond_read_acquire(), but only truly\nacquires the lock when the compare-and-exchange is completed\nsuccessfully which isn\u2019t ordered. This exposes the window between the\nacquire and the cmpxchg to an A-B-A problem which allows reads\nfollowing the lock acquisition to observe values speculatively before\nthe write lock is truly acquired.\nWe've seen a problem in epoll where the reader does a xchg while\nholding the read lock, but the writer can see a value change out from\nunder it.\nWriter | Reader\n--------------------------------------------------------------------------------\nep_scan_ready_list() |\n|- write_lock_irq() |\n|- queued_write_lock_slowpath() |\n|- atomic_cond_read_acquire() |\n| read_lock_irqsave(&ep->lock, flags);\n--> (observes value before unlock) | chain_epi_lockless()\n| | epi->next = xchg(&ep->ovflist, epi);\n| | read_unlock_irqrestore(&ep->lock, flags);\n| |\n| atomic_cmpxchg_relaxed() |\n|-- READ_ONCE(ep->ovflist); |\nA core can order the read of the ovflist ahead of the\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\nsemantics addresses this issue at which point the atomic_cond_read can\nbe switched to use relaxed semantics.\n[peterz: use try_cmpxchg()]"], "name": "CVE-2021-46921", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-46921\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-46921\nhttps://lore.kernel.org/linux-cve-announce/2024022732-CVE-2021-46921-91dc@gregkh/T/#u"], "threat_severity": "Low"}

{}