CVE-2021-47544

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47544", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-24T15:02:54.829Z", "datePublished": "2024-05-24T15:09:49.895Z", "dateUpdated": "2026-08-05T08:48:19.884Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:19.884Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix page frag corruption on page fault\n\nSteffen reported a TCP stream corruption for HTTP requests\nserved by the apache web-server using a cifs mount-point\nand memory mapping the relevant file.\n\nThe root cause is quite similar to the one addressed by\ncommit 20eb4f29b602 (\"net: fix sk_page_frag() recursion from\nmemory reclaim\"). Here the nested access to the task page frag\nis caused by a page fault on the (mmapped) user-space memory\nbuffer coming from the cifs file.\n\nThe page fault handler performs an smb transaction on a different\nsocket, inside the same process context. Since sk->sk_allaction\nfor such socket does not prevent the usage for the task_frag,\nthe nested allocation modify \"under the hood\" the page frag\nin use by the outer sendmsg call, corrupting the stream.\n\nThe overall relevant stack trace looks like the following:\n\nhttpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked:\n ffffffff91461d91 tcp_sendmsg_locked+0x1\n ffffffff91462b57 tcp_sendmsg+0x27\n ffffffff9139814e sock_sendmsg+0x3e\n ffffffffc06dfe1d smb_send_kvec+0x28\n [...]\n ffffffffc06cfaf8 cifs_readpages+0x213\n ffffffff90e83c4b read_pages+0x6b\n ffffffff90e83f31 __do_page_cache_readahead+0x1c1\n ffffffff90e79e98 filemap_fault+0x788\n ffffffff90eb0458 __do_fault+0x38\n ffffffff90eb5280 do_fault+0x1a0\n ffffffff90eb7c84 __handle_mm_fault+0x4d4\n ffffffff90eb8093 handle_mm_fault+0xc3\n ffffffff90c74f6d __do_page_fault+0x1ed\n ffffffff90c75277 do_page_fault+0x37\n ffffffff9160111e page_fault+0x1e\n ffffffff9109e7b5 copyin+0x25\n ffffffff9109eb40 _copy_from_iter_full+0xe0\n ffffffff91462370 tcp_sendmsg_locked+0x5e0\n ffffffff91462370 tcp_sendmsg_locked+0x5e0\n ffffffff91462b57 tcp_sendmsg+0x27\n ffffffff9139815c sock_sendmsg+0x4c\n ffffffff913981f7 sock_write_iter+0x97\n ffffffff90f2cc56 do_iter_readv_writev+0x156\n ffffffff90f2dff0 do_iter_write+0x80\n ffffffff90f2e1c3 vfs_writev+0xa3\n ffffffff90f2e27c do_writev+0x5c\n ffffffff90c042bb do_syscall_64+0x5b\n ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65\n\nThe cifs filesystem rightfully sets sk_allocations to GFP_NOFS,\nwe can avoid the nesting using the sk page frag for allocation\nlacking the __GFP_FS flag. Do not define an additional mm-helper\nfor that, as this is strictly tied to the sk page frag usage.\n\nv1 -> v2:\n - use a stricted sk_page_frag() check instead of reordering the\n code (Eric)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - Worst reasonable case is an internet-facing service (e.g. HTTP) sending mmap\u2019d content from a GFP_NOFS/GFP_NOIO network filesystem (CIFS/Ceph/9p), so a remote peer\u2019s requests drive the vulnerable tcp_sendmsg/sk_page_frag path without local shell access.\nAC:L - Given that deployment, the attacker can reliably force page faults by requesting uncached network-FS-backed data; nesting is deterministic on fault, not a race or layout condition outside attacker influence.\nPR:N - Unauthenticated remote clients of the network-facing service need no host account or capabilities; the vulnerable send path runs in the server process on their requests.\nUI:N - No separate victim action is required beyond the service already serving network-FS-backed buffers; the attacker\u2019s requests alone trigger sendmsg and the nested fault path.\nS:U - Impact is kernel memory corruption and privilege escalation within the same host kernel authority, not a VM/IOMMU or other cross-boundary escape.\nC:H - Corrupted page-frag state can attach and transmit unintended page contents (including nested SMB/FS data or adjacent bytes), and the subsequent size-offset underflow OOB enables broader kernel memory disclosure.\nI:H - Nested task_frag mutation yields out-of-bounds writes past page-frag buffers via unsigned size-offset underflow into copy_from_iter, which is heap memory corruption exploitable for arbitrary write/control-flow hijack.\nA:H - The same OOB/heap corruption can oops or panic the kernel, and related task_frag recursion bugs have manifested as crashes even when not fully exploited."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sock.h"], "versions": [{"version": "5640f7685831e088fe6c2e1f863a6805962f8e81", "lessThan": "c6f340a331fb72e5ac23a083de9c780e132ca3ae", "status": "affected", "versionType": "git"}, {"version": "5640f7685831e088fe6c2e1f863a6805962f8e81", "lessThan": "5a9afcd827cafe14a95c9fcbded2c2d104f18dfc", "status": "affected", "versionType": "git"}, {"version": "5640f7685831e088fe6c2e1f863a6805962f8e81", "lessThan": "dacb5d8875cc6cd3a553363b4d6f06760fcbe70c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sock.h"], "versions": [{"version": "3.7", "status": "affected"}, {"version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.84", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.7", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.10.84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c6f340a331fb72e5ac23a083de9c780e132ca3ae"}, {"url": "https://git.kernel.org/stable/c/5a9afcd827cafe14a95c9fcbded2c2d104f18dfc"}, {"url": "https://git.kernel.org/stable/c/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c"}], "title": "tcp: fix page frag corruption on page fault", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47544", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T17:06:35.022552Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:15:09.727Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.619Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c6f340a331fb72e5ac23a083de9c780e132ca3ae", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5a9afcd827cafe14a95c9fcbded2c2d104f18dfc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c6f340a331fb72e5ac23a083de9c780e132ca3ae", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5a9afcd827cafe14a95c9fcbded2c2d104f18dfc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.619Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47544", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T17:06:35.022552Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T17:06:38.931Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "tcp: fix page frag corruption on page fault", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - Worst reasonable case is an internet-facing service (e.g. HTTP) sending mmap\u2019d content from a GFP_NOFS/GFP_NOIO network filesystem (CIFS/Ceph/9p), so a remote peer\u2019s requests drive the vulnerable tcp_sendmsg/sk_page_frag path without local shell access.\nAC:L - Given that deployment, the attacker can reliably force page faults by requesting uncached network-FS-backed data; nesting is deterministic on fault, not a race or layout condition outside attacker influence.\nPR:N - Unauthenticated remote clients of the network-facing service need no host account or capabilities; the vulnerable send path runs in the server process on their requests.\nUI:N - No separate victim action is required beyond the service already serving network-FS-backed buffers; the attacker\u2019s requests alone trigger sendmsg and the nested fault path.\nS:U - Impact is kernel memory corruption and privilege escalation within the same host kernel authority, not a VM/IOMMU or other cross-boundary escape.\nC:H - Corrupted page-frag state can attach and transmit unintended page contents (including nested SMB/FS data or adjacent bytes), and the subsequent size-offset underflow OOB enables broader kernel memory disclosure.\nI:H - Nested task_frag mutation yields out-of-bounds writes past page-frag buffers via unsigned size-offset underflow into copy_from_iter, which is heap memory corruption exploitable for arbitrary write/control-flow hijack.\nA:H - The same OOB/heap corruption can oops or panic the kernel, and related task_frag recursion bugs have manifested as crashes even when not fully exploited."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5640f7685831e088fe6c2e1f863a6805962f8e81", "lessThan": "c6f340a331fb72e5ac23a083de9c780e132ca3ae", "versionType": "git"}, {"status": "affected", "version": "5640f7685831e088fe6c2e1f863a6805962f8e81", "lessThan": "5a9afcd827cafe14a95c9fcbded2c2d104f18dfc", "versionType": "git"}, {"status": "affected", "version": "5640f7685831e088fe6c2e1f863a6805962f8e81", "lessThan": "dacb5d8875cc6cd3a553363b4d6f06760fcbe70c", "versionType": "git"}], "programFiles": ["include/net/sock.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"status": "unaffected", "version": "0", "lessThan": "3.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.84", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.7", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/sock.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c6f340a331fb72e5ac23a083de9c780e132ca3ae"}, {"url": "https://git.kernel.org/stable/c/5a9afcd827cafe14a95c9fcbded2c2d104f18dfc"}, {"url": "https://git.kernel.org/stable/c/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix page frag corruption on page fault\n\nSteffen reported a TCP stream corruption for HTTP requests\nserved by the apache web-server using a cifs mount-point\nand memory mapping the relevant file.\n\nThe root cause is quite similar to the one addressed by\ncommit 20eb4f29b602 (\"net: fix sk_page_frag() recursion from\nmemory reclaim\"). Here the nested access to the task page frag\nis caused by a page fault on the (mmapped) user-space memory\nbuffer coming from the cifs file.\n\nThe page fault handler performs an smb transaction on a different\nsocket, inside the same process context. Since sk->sk_allaction\nfor such socket does not prevent the usage for the task_frag,\nthe nested allocation modify \"under the hood\" the page frag\nin use by the outer sendmsg call, corrupting the stream.\n\nThe overall relevant stack trace looks like the following:\n\nhttpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked:\n ffffffff91461d91 tcp_sendmsg_locked+0x1\n ffffffff91462b57 tcp_sendmsg+0x27\n ffffffff9139814e sock_sendmsg+0x3e\n ffffffffc06dfe1d smb_send_kvec+0x28\n [...]\n ffffffffc06cfaf8 cifs_readpages+0x213\n ffffffff90e83c4b read_pages+0x6b\n ffffffff90e83f31 __do_page_cache_readahead+0x1c1\n ffffffff90e79e98 filemap_fault+0x788\n ffffffff90eb0458 __do_fault+0x38\n ffffffff90eb5280 do_fault+0x1a0\n ffffffff90eb7c84 __handle_mm_fault+0x4d4\n ffffffff90eb8093 handle_mm_fault+0xc3\n ffffffff90c74f6d __do_page_fault+0x1ed\n ffffffff90c75277 do_page_fault+0x37\n ffffffff9160111e page_fault+0x1e\n ffffffff9109e7b5 copyin+0x25\n ffffffff9109eb40 _copy_from_iter_full+0xe0\n ffffffff91462370 tcp_sendmsg_locked+0x5e0\n ffffffff91462370 tcp_sendmsg_locked+0x5e0\n ffffffff91462b57 tcp_sendmsg+0x27\n ffffffff9139815c sock_sendmsg+0x4c\n ffffffff913981f7 sock_write_iter+0x97\n ffffffff90f2cc56 do_iter_readv_writev+0x156\n ffffffff90f2dff0 do_iter_write+0x80\n ffffffff90f2e1c3 vfs_writev+0xa3\n ffffffff90f2e27c do_writev+0x5c\n ffffffff90c042bb do_syscall_64+0x5b\n ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65\n\nThe cifs filesystem rightfully sets sk_allocations to GFP_NOFS,\nwe can avoid the nesting using the sk page frag for allocation\nlacking the __GFP_FS flag. Do not define an additional mm-helper\nfor that, as this is strictly tied to the sk page frag usage.\n\nv1 -> v2:\n - use a stricted sk_page_frag() check instead of reordering the\n code (Eric)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.84", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.7", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16", "versionStartIncluding": "3.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:19.884Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47544", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:48:19.884Z", "dateReserved": "2024-05-24T15:02:54.829Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-24T15:09:49.895Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/sock.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c6f340a331fb72e5ac23a083de9c780e132ca3ae", "status": "affected", "version": "5640f7685831e088fe6c2e1f863a6805962f8e81", "versionType": "git"}, {"lessThan": "5a9afcd827cafe14a95c9fcbded2c2d104f18dfc", "status": "affected", "version": "5640f7685831e088fe6c2e1f863a6805962f8e81", "versionType": "git"}, {"lessThan": "dacb5d8875cc6cd3a553363b4d6f06760fcbe70c", "status": "affected", "version": "5640f7685831e088fe6c2e1f863a6805962f8e81", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/sock.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"lessThan": "3.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.84", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B3EF163-4174-46D1-9BAB-630C7D7DBB5E", "versionEndExcluding": "5.10.84", "versionStartIncluding": "3.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A696A60B-2782-4119-83DD-1EFFBC903F02", "versionEndExcluding": "5.15.7", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "357AA433-37E8-4323-BFB2-3038D6E4B414", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "A73429BA-C2D9-4D0C-A75F-06A1CA8B3983", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "F621B5E3-E99D-49E7-90B9-EC3B77C95383", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix page frag corruption on page fault\n\nSteffen reported a TCP stream corruption for HTTP requests\nserved by the apache web-server using a cifs mount-point\nand memory mapping the relevant file.\n\nThe root cause is quite similar to the one addressed by\ncommit 20eb4f29b602 (\"net: fix sk_page_frag() recursion from\nmemory reclaim\"). Here the nested access to the task page frag\nis caused by a page fault on the (mmapped) user-space memory\nbuffer coming from the cifs file.\n\nThe page fault handler performs an smb transaction on a different\nsocket, inside the same process context. Since sk->sk_allaction\nfor such socket does not prevent the usage for the task_frag,\nthe nested allocation modify \"under the hood\" the page frag\nin use by the outer sendmsg call, corrupting the stream.\n\nThe overall relevant stack trace looks like the following:\n\nhttpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked:\n ffffffff91461d91 tcp_sendmsg_locked+0x1\n ffffffff91462b57 tcp_sendmsg+0x27\n ffffffff9139814e sock_sendmsg+0x3e\n ffffffffc06dfe1d smb_send_kvec+0x28\n [...]\n ffffffffc06cfaf8 cifs_readpages+0x213\n ffffffff90e83c4b read_pages+0x6b\n ffffffff90e83f31 __do_page_cache_readahead+0x1c1\n ffffffff90e79e98 filemap_fault+0x788\n ffffffff90eb0458 __do_fault+0x38\n ffffffff90eb5280 do_fault+0x1a0\n ffffffff90eb7c84 __handle_mm_fault+0x4d4\n ffffffff90eb8093 handle_mm_fault+0xc3\n ffffffff90c74f6d __do_page_fault+0x1ed\n ffffffff90c75277 do_page_fault+0x37\n ffffffff9160111e page_fault+0x1e\n ffffffff9109e7b5 copyin+0x25\n ffffffff9109eb40 _copy_from_iter_full+0xe0\n ffffffff91462370 tcp_sendmsg_locked+0x5e0\n ffffffff91462370 tcp_sendmsg_locked+0x5e0\n ffffffff91462b57 tcp_sendmsg+0x27\n ffffffff9139815c sock_sendmsg+0x4c\n ffffffff913981f7 sock_write_iter+0x97\n ffffffff90f2cc56 do_iter_readv_writev+0x156\n ffffffff90f2dff0 do_iter_write+0x80\n ffffffff90f2e1c3 vfs_writev+0xa3\n ffffffff90f2e27c do_writev+0x5c\n ffffffff90c042bb do_syscall_64+0x5b\n ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65\n\nThe cifs filesystem rightfully sets sk_allocations to GFP_NOFS,\nwe can avoid the nesting using the sk page frag for allocation\nlacking the __GFP_FS flag. Do not define an additional mm-helper\nfor that, as this is strictly tied to the sk page frag usage.\n\nv1 -> v2:\n - use a stricted sk_page_frag() check instead of reordering the\n code (Eric)"}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: tcp: corregir corrupci\u00f3n de fragmentos de p\u00e1gina en falla de p\u00e1gina Steffen inform\u00f3 una corrupci\u00f3n de flujo TCP para solicitudes HTTP atendidas por el servidor web Apache usando un punto de montaje cifs y mapeando la memoria del archivo relevante. La causa ra\u00edz es bastante similar a la abordada por el commit 20eb4f29b602 (\"net: fix sk_page_frag() recursividad desde la recuperaci\u00f3n de memoria\"). Aqu\u00ed, el acceso anidado al fragmento de la p\u00e1gina de tareas se debe a un error de p\u00e1gina en el b\u00fafer de memoria del espacio de usuario (mapeado) proveniente del archivo cifs. El controlador de errores de p\u00e1gina realiza una transacci\u00f3n smb en un socket diferente, dentro del mismo contexto de proceso. Dado que sk->sk_allaction para dicho socket no impide el uso de task_frag, la asignaci\u00f3n anidada modifica \"bajo el cap\u00f3\" el fragmento de p\u00e1gina en uso por la llamada externa sendmsg, corrompiendo la secuencia. El seguimiento general de la pila relevante se parece al siguiente: httpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked: fffffff91461d91 tcp_sendmsg_locked+0x1 ffffffff91462b57 tcp_sendmsg+0x27 sock_sendmsg+0x3e ffffffffc06dfe1d smb_send_kvec+0x28 [...] ffffffffc06cfaf8 cifs_readpages+0x213 ffffffff90e83c4b read_pages+0x6b ffffffff90e83f31 __do_page_cache_readahead+0x1c1 ffffffff90e79e98 filemap_fault+0x788 ffffffff90eb0458 __do_fault+0x38 ffffffff90eb5280 do_fault+0x1a0 ffffffff90eb7c84 x4d4 ffffffff90eb8093 handle_mm_fault+0xc3 ffffffff90c74f6d __do_page_fault+0x1ed ffffffff90c75277 do_page_fault+0x37 ffffffff9160111e page_fault+0x1e ffffffff9109e7b5 copyin+0x25 9109eb40 _copia_de_iter_full+0xe0 ffffffff91462370 tcp_sendmsg_locked+0x5e0 ffffffff91462370 tcp_sendmsg_locked +0x5e0 ffffffff91462b57 tcp_sendmsg+0x27 ffffffff9139815c sock_sendmsg+0x4c ffffffff913981f7 sock_write_iter+0x97 ffffffff90f2cc56 do_iter_readv_writev+0x156 0 do_iter_write+0x80 ffffffff90f2e1c3 vfs_writev+0xa3 ffffffff90f2e27c do_writev+0x5c ffffffff90c042bb do_syscall_64+0x5b ffffffff916000ad Entry_SYSCALL_64_after_hwframe+0x65 El sistema de archivos cifs establece correctamente sk_allocations a GFP_NOFS, podemos evitar el anidamiento utilizando el fragmento de p\u00e1gina sk para la asignaci\u00f3n que carece del indicador __GFP_FS. No defina un mm-helper adicional para eso, ya que est\u00e1 estrictamente vinculado al uso del fragmento de p\u00e1gina sk. v1 -> v2: - use una verificaci\u00f3n estricta de sk_page_frag() en lugar de reordenar el c\u00f3digo (Eric)"}], "id": "CVE-2021-47544", "lastModified": "2026-08-04T10:17:08.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47544", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-28T17:06:35.022552Z", "version": "2.0.3"}}]}, "published": "2024-05-24T15:15:18.983", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5a9afcd827cafe14a95c9fcbded2c2d104f18dfc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c6f340a331fb72e5ac23a083de9c780e132ca3ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5a9afcd827cafe14a95c9fcbded2c2d104f18dfc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c6f340a331fb72e5ac23a083de9c780e132ca3ae"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dacb5d8875cc6cd3a553363b4d6f06760fcbe70c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2022:1975", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-372.9.1.rt7.166.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-05-10T00:00:00Z"}, {"advisory": "RHSA-2022:1988", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-372.9.1.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-05-10T00:00:00Z"}, {"advisory": "RHSA-2023:0395", "cpe": "cpe:/o:redhat:rhel_aus:8.2", "package": "kernel-0:4.18.0-193.98.1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2023-01-24T00:00:00Z"}, {"advisory": "RHSA-2023:0395", "cpe": "cpe:/o:redhat:rhel_tus:8.2", "package": "kernel-0:4.18.0-193.98.1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2023-01-24T00:00:00Z"}, {"advisory": "RHSA-2023:0395", "cpe": "cpe:/o:redhat:rhel_e4s:8.2", "package": "kernel-0:4.18.0-193.98.1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2023-01-24T00:00:00Z"}, {"advisory": "RHSA-2022:0777", "cpe": "cpe:/o:redhat:rhel_eus:8.4", "package": "kernel-0:4.18.0-305.40.1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-03-08T00:00:00Z"}], "bugzilla": {"description": "kernel: tcp: fix page frag corruption on page fault", "id": "2283406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283406"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "verified"}, "cwe": "CWE-119", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntcp: fix page frag corruption on page fault\nSteffen reported a TCP stream corruption for HTTP requests\nserved by the apache web-server using a cifs mount-point\nand memory mapping the relevant file.\nThe root cause is quite similar to the one addressed by\ncommit 20eb4f29b602 (\"net: fix sk_page_frag() recursion from\nmemory reclaim\"). Here the nested access to the task page frag\nis caused by a page fault on the (mmapped) user-space memory\nbuffer coming from the cifs file.\nThe page fault handler performs an smb transaction on a different\nsocket, inside the same process context. Since sk->sk_allaction\nfor such socket does not prevent the usage for the task_frag,\nthe nested allocation modify \"under the hood\" the page frag\nin use by the outer sendmsg call, corrupting the stream.\nThe overall relevant stack trace looks like the following:\nhttpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked:\nffffffff91461d91 tcp_sendmsg_locked+0x1\nffffffff91462b57 tcp_sendmsg+0x27\nffffffff9139814e sock_sendmsg+0x3e\nffffffffc06dfe1d smb_send_kvec+0x28\n[...]\nffffffffc06cfaf8 cifs_readpages+0x213\nffffffff90e83c4b read_pages+0x6b\nffffffff90e83f31 __do_page_cache_readahead+0x1c1\nffffffff90e79e98 filemap_fault+0x788\nffffffff90eb0458 __do_fault+0x38\nffffffff90eb5280 do_fault+0x1a0\nffffffff90eb7c84 __handle_mm_fault+0x4d4\nffffffff90eb8093 handle_mm_fault+0xc3\nffffffff90c74f6d __do_page_fault+0x1ed\nffffffff90c75277 do_page_fault+0x37\nffffffff9160111e page_fault+0x1e\nffffffff9109e7b5 copyin+0x25\nffffffff9109eb40 _copy_from_iter_full+0xe0\nffffffff91462370 tcp_sendmsg_locked+0x5e0\nffffffff91462370 tcp_sendmsg_locked+0x5e0\nffffffff91462b57 tcp_sendmsg+0x27\nffffffff9139815c sock_sendmsg+0x4c\nffffffff913981f7 sock_write_iter+0x97\nffffffff90f2cc56 do_iter_readv_writev+0x156\nffffffff90f2dff0 do_iter_write+0x80\nffffffff90f2e1c3 vfs_writev+0xa3\nffffffff90f2e27c do_writev+0x5c\nffffffff90c042bb do_syscall_64+0x5b\nffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65\nThe cifs filesystem rightfully sets sk_allocations to GFP_NOFS,\nwe can avoid the nesting using the sk page frag for allocation\nlacking the __GFP_FS flag. Do not define an additional mm-helper\nfor that, as this is strictly tied to the sk page frag usage.\nv1 -> v2:\n- use a stricted sk_page_frag() check instead of reordering the\ncode (Eric)"], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2021-47544", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47544\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47544\nhttps://lore.kernel.org/linux-cve-announce/2024052440-CVE-2021-47544-ceb5@gregkh/T"], "threat_severity": "Moderate"}

{}