CVE-2021-46921 (GCVE-0-2021-46921)
Vulnerability from cvelistv5 – Published: 2024-02-27 09:36 – Updated: 2025-05-04 07:00
VLAI?
Title
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
Summary
In the Linux kernel, the following vulnerability has been resolved:
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
While this code is executed with the wait_lock held, a reader can
acquire the lock without holding wait_lock. The writer side loops
checking the value with the atomic_cond_read_acquire(), but only truly
acquires the lock when the compare-and-exchange is completed
successfully which isn’t ordered. This exposes the window between the
acquire and the cmpxchg to an A-B-A problem which allows reads
following the lock acquisition to observe values speculatively before
the write lock is truly acquired.
We've seen a problem in epoll where the reader does a xchg while
holding the read lock, but the writer can see a value change out from
under it.
Writer | Reader
--------------------------------------------------------------------------------
ep_scan_ready_list() |
|- write_lock_irq() |
|- queued_write_lock_slowpath() |
|- atomic_cond_read_acquire() |
| read_lock_irqsave(&ep->lock, flags);
--> (observes value before unlock) | chain_epi_lockless()
| | epi->next = xchg(&ep->ovflist, epi);
| | read_unlock_irqrestore(&ep->lock, flags);
| |
| atomic_cmpxchg_relaxed() |
|-- READ_ONCE(ep->ovflist); |
A core can order the read of the ovflist ahead of the
atomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire
semantics addresses this issue at which point the atomic_cond_read can
be switched to use relaxed semantics.
[peterz: use try_cmpxchg()]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
b519b56e378ee82caf9b079b04f5db87dedc3251 , < 5902f9453a313be8fe78cbd7e7ca9dba9319fc6e
(git)
Affected: b519b56e378ee82caf9b079b04f5db87dedc3251 , < 82808cc026811fbc3ecf0c0b267a12a339eead56 (git) Affected: b519b56e378ee82caf9b079b04f5db87dedc3251 , < 82fa9ced35d88581cffa4a1c856fc41fca96d80a (git) Affected: b519b56e378ee82caf9b079b04f5db87dedc3251 , < d558fcdb17139728347bccc60a16af3e639649d2 (git) Affected: b519b56e378ee82caf9b079b04f5db87dedc3251 , < 84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896 (git) |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-46921",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-27T16:11:46.310286Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:22:01.427Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:17:42.848Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/locking/qrwlock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5902f9453a313be8fe78cbd7e7ca9dba9319fc6e",
"status": "affected",
"version": "b519b56e378ee82caf9b079b04f5db87dedc3251",
"versionType": "git"
},
{
"lessThan": "82808cc026811fbc3ecf0c0b267a12a339eead56",
"status": "affected",
"version": "b519b56e378ee82caf9b079b04f5db87dedc3251",
"versionType": "git"
},
{
"lessThan": "82fa9ced35d88581cffa4a1c856fc41fca96d80a",
"status": "affected",
"version": "b519b56e378ee82caf9b079b04f5db87dedc3251",
"versionType": "git"
},
{
"lessThan": "d558fcdb17139728347bccc60a16af3e639649d2",
"status": "affected",
"version": "b519b56e378ee82caf9b079b04f5db87dedc3251",
"versionType": "git"
},
{
"lessThan": "84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896",
"status": "affected",
"version": "b519b56e378ee82caf9b079b04f5db87dedc3251",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/locking/qrwlock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.11.*",
"status": "unaffected",
"version": "5.11.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.189",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.115",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.33",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.17",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.12",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\n\nWhile this code is executed with the wait_lock held, a reader can\nacquire the lock without holding wait_lock. The writer side loops\nchecking the value with the atomic_cond_read_acquire(), but only truly\nacquires the lock when the compare-and-exchange is completed\nsuccessfully which isn\u2019t ordered. This exposes the window between the\nacquire and the cmpxchg to an A-B-A problem which allows reads\nfollowing the lock acquisition to observe values speculatively before\nthe write lock is truly acquired.\n\nWe\u0027ve seen a problem in epoll where the reader does a xchg while\nholding the read lock, but the writer can see a value change out from\nunder it.\n\n Writer | Reader\n --------------------------------------------------------------------------------\n ep_scan_ready_list() |\n |- write_lock_irq() |\n |- queued_write_lock_slowpath() |\n\t|- atomic_cond_read_acquire() |\n\t\t\t\t | read_lock_irqsave(\u0026ep-\u003elock, flags);\n --\u003e (observes value before unlock) | chain_epi_lockless()\n | | epi-\u003enext = xchg(\u0026ep-\u003eovflist, epi);\n | | read_unlock_irqrestore(\u0026ep-\u003elock, flags);\n | |\n | atomic_cmpxchg_relaxed() |\n |-- READ_ONCE(ep-\u003eovflist); |\n\nA core can order the read of the ovflist ahead of the\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\nsemantics addresses this issue at which point the atomic_cond_read can\nbe switched to use relaxed semantics.\n\n[peterz: use try_cmpxchg()]"
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T07:00:23.829Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e"
},
{
"url": "https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56"
},
{
"url": "https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a"
},
{
"url": "https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2"
},
{
"url": "https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896"
}
],
"title": "locking/qrwlock: Fix ordering in queued_write_lock_slowpath()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-46921",
"datePublished": "2024-02-27T09:36:26.461Z",
"dateReserved": "2024-02-25T13:45:52.719Z",
"dateUpdated": "2025-05-04T07:00:23.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:17:42.848Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-46921\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-27T16:11:46.310286Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:40.966Z\"}}], \"cna\": {\"title\": \"locking/qrwlock: Fix ordering in queued_write_lock_slowpath()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b519b56e378ee82caf9b079b04f5db87dedc3251\", \"lessThan\": \"5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b519b56e378ee82caf9b079b04f5db87dedc3251\", \"lessThan\": \"82808cc026811fbc3ecf0c0b267a12a339eead56\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b519b56e378ee82caf9b079b04f5db87dedc3251\", \"lessThan\": \"82fa9ced35d88581cffa4a1c856fc41fca96d80a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b519b56e378ee82caf9b079b04f5db87dedc3251\", \"lessThan\": \"d558fcdb17139728347bccc60a16af3e639649d2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b519b56e378ee82caf9b079b04f5db87dedc3251\", \"lessThan\": \"84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/locking/qrwlock.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.189\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.115\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.11.17\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.11.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/locking/qrwlock.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\"}, {\"url\": \"https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56\"}, {\"url\": \"https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a\"}, {\"url\": \"https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2\"}, {\"url\": \"https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\\n\\nWhile this code is executed with the wait_lock held, a reader can\\nacquire the lock without holding wait_lock. The writer side loops\\nchecking the value with the atomic_cond_read_acquire(), but only truly\\nacquires the lock when the compare-and-exchange is completed\\nsuccessfully which isn\\u2019t ordered. This exposes the window between the\\nacquire and the cmpxchg to an A-B-A problem which allows reads\\nfollowing the lock acquisition to observe values speculatively before\\nthe write lock is truly acquired.\\n\\nWe\u0027ve seen a problem in epoll where the reader does a xchg while\\nholding the read lock, but the writer can see a value change out from\\nunder it.\\n\\n Writer | Reader\\n --------------------------------------------------------------------------------\\n ep_scan_ready_list() |\\n |- write_lock_irq() |\\n |- queued_write_lock_slowpath() |\\n\\t|- atomic_cond_read_acquire() |\\n\\t\\t\\t\\t | read_lock_irqsave(\u0026ep-\u003elock, flags);\\n --\u003e (observes value before unlock) | chain_epi_lockless()\\n | | epi-\u003enext = xchg(\u0026ep-\u003eovflist, epi);\\n | | read_unlock_irqrestore(\u0026ep-\u003elock, flags);\\n | |\\n | atomic_cmpxchg_relaxed() |\\n |-- READ_ONCE(ep-\u003eovflist); |\\n\\nA core can order the read of the ovflist ahead of the\\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\\nsemantics addresses this issue at which point the atomic_cond_read can\\nbe switched to use relaxed semantics.\\n\\n[peterz: use try_cmpxchg()]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.189\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.115\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.33\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.11.17\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12\", \"versionStartIncluding\": \"4.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:00:23.829Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-46921\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:00:23.829Z\", \"dateReserved\": \"2024-02-25T13:45:52.719Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-27T09:36:26.461Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…