CVE-2021-47553 (GCVE-0-2021-47553)

Vulnerability from cvelistv5 – Published: 2024-05-24 15:09 – Updated: 2025-05-04 12:41
VLAI?
Title
sched/scs: Reset task stack state in bringup_cpu()
Summary
In the Linux kernel, the following vulnerability has been resolved: sched/scs: Reset task stack state in bringup_cpu() To hot unplug a CPU, the idle task on that CPU calls a few layers of C code before finally leaving the kernel. When KASAN is in use, poisoned shadow is left around for each of the active stack frames, and when shadow call stacks are in use. When shadow call stacks (SCS) are in use the task's saved SCS SP is left pointing at an arbitrary point within the task's shadow call stack. When a CPU is offlined than onlined back into the kernel, this stale state can adversely affect execution. Stale KASAN shadow can alias new stackframes and result in bogus KASAN warnings. A stale SCS SP is effectively a memory leak, and prevents a portion of the shadow call stack being used. Across a number of hotplug cycles the idle task's entire shadow call stack can become unusable. We previously fixed the KASAN issue in commit: e1b77c92981a5222 ("sched/kasan: remove stale KASAN poison after hotplug") ... by removing any stale KASAN stack poison immediately prior to onlining a CPU. Subsequently in commit: f1a0a376ca0c4ef1 ("sched/core: Initialize the idle task with preemption disabled") ... the refactoring left the KASAN and SCS cleanup in one-time idle thread initialization code rather than something invoked prior to each CPU being onlined, breaking both as above. We fixed SCS (but not KASAN) in commit: 63acd42c0d4942f7 ("sched/scs: Reset the shadow stack when idle_task_exit") ... but as this runs in the context of the idle task being offlined it's potentially fragile. To fix these consistently and more robustly, reset the SCS SP and KASAN shadow of a CPU's idle task immediately before we online that CPU in bringup_cpu(). This ensures the idle task always has a consistent state when it is running, and removes the need to so so when exiting an idle task. Whenever any thread is created, dup_task_struct() will give the task a stack which is free of KASAN shadow, and initialize the task's SCS SP, so there's no need to specially initialize either for idle thread within init_idle(), as this was only necessary to handle hotplug cycles. I've tested this on arm64 with: * gcc 11.1.0, defconfig +KASAN_INLINE, KASAN_STACK * clang 12.0.0, defconfig +KASAN_INLINE, KASAN_STACK, SHADOW_CALL_STACK ... offlining and onlining CPUS with: | while true; do | for C in /sys/devices/system/cpu/cpu*/online; do | echo 0 > $C; | echo 1 > $C; | done | done
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3c51d82d0b7862d7d246016c74b4390fb1fa1f11 , < e6ee7abd6bfe559ad9989004b34c320fd638c526 (git)
Affected: f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674 , < 229c555260cb9c1ccdab861e16f0410f1718f302 (git)
Affected: f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674 , < dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3 (git)
Affected: 1cb358b3ac1bb43aa8c4283830a84216dda65d39 (git)
Affected: 24c79a7e54ccfa29fb8cbf7ed8d1e48ff1ec6e3d (git)
Create a notification for this product.
    Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.10.83 , ≤ 5.10.* (semver)
Unaffected: 5.15.6 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T19:56:42.885646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T19:57:05.890Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.871Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e6ee7abd6bfe559ad9989004b34c320fd638c526"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/229c555260cb9c1ccdab861e16f0410f1718f302"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/cpu.c",
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e6ee7abd6bfe559ad9989004b34c320fd638c526",
              "status": "affected",
              "version": "3c51d82d0b7862d7d246016c74b4390fb1fa1f11",
              "versionType": "git"
            },
            {
              "lessThan": "229c555260cb9c1ccdab861e16f0410f1718f302",
              "status": "affected",
              "version": "f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674",
              "versionType": "git"
            },
            {
              "lessThan": "dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3",
              "status": "affected",
              "version": "f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1cb358b3ac1bb43aa8c4283830a84216dda65d39",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "24c79a7e54ccfa29fb8cbf7ed8d1e48ff1ec6e3d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/cpu.c",
            "kernel/sched/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.83",
                  "versionStartIncluding": "5.10.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.6",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.12.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/scs: Reset task stack state in bringup_cpu()\n\nTo hot unplug a CPU, the idle task on that CPU calls a few layers of C\ncode before finally leaving the kernel. When KASAN is in use, poisoned\nshadow is left around for each of the active stack frames, and when\nshadow call stacks are in use. When shadow call stacks (SCS) are in use\nthe task\u0027s saved SCS SP is left pointing at an arbitrary point within\nthe task\u0027s shadow call stack.\n\nWhen a CPU is offlined than onlined back into the kernel, this stale\nstate can adversely affect execution. Stale KASAN shadow can alias new\nstackframes and result in bogus KASAN warnings. A stale SCS SP is\neffectively a memory leak, and prevents a portion of the shadow call\nstack being used. Across a number of hotplug cycles the idle task\u0027s\nentire shadow call stack can become unusable.\n\nWe previously fixed the KASAN issue in commit:\n\n  e1b77c92981a5222 (\"sched/kasan: remove stale KASAN poison after hotplug\")\n\n... by removing any stale KASAN stack poison immediately prior to\nonlining a CPU.\n\nSubsequently in commit:\n\n  f1a0a376ca0c4ef1 (\"sched/core: Initialize the idle task with preemption disabled\")\n\n... the refactoring left the KASAN and SCS cleanup in one-time idle\nthread initialization code rather than something invoked prior to each\nCPU being onlined, breaking both as above.\n\nWe fixed SCS (but not KASAN) in commit:\n\n  63acd42c0d4942f7 (\"sched/scs: Reset the shadow stack when idle_task_exit\")\n\n... but as this runs in the context of the idle task being offlined it\u0027s\npotentially fragile.\n\nTo fix these consistently and more robustly, reset the SCS SP and KASAN\nshadow of a CPU\u0027s idle task immediately before we online that CPU in\nbringup_cpu(). This ensures the idle task always has a consistent state\nwhen it is running, and removes the need to so so when exiting an idle\ntask.\n\nWhenever any thread is created, dup_task_struct() will give the task a\nstack which is free of KASAN shadow, and initialize the task\u0027s SCS SP,\nso there\u0027s no need to specially initialize either for idle thread within\ninit_idle(), as this was only necessary to handle hotplug cycles.\n\nI\u0027ve tested this on arm64 with:\n\n* gcc 11.1.0, defconfig +KASAN_INLINE, KASAN_STACK\n* clang 12.0.0, defconfig +KASAN_INLINE, KASAN_STACK, SHADOW_CALL_STACK\n\n... offlining and onlining CPUS with:\n\n| while true; do\n|   for C in /sys/devices/system/cpu/cpu*/online; do\n|     echo 0 \u003e $C;\n|     echo 1 \u003e $C;\n|   done\n| done"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:41:41.530Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e6ee7abd6bfe559ad9989004b34c320fd638c526"
        },
        {
          "url": "https://git.kernel.org/stable/c/229c555260cb9c1ccdab861e16f0410f1718f302"
        },
        {
          "url": "https://git.kernel.org/stable/c/dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3"
        }
      ],
      "title": "sched/scs: Reset task stack state in bringup_cpu()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47553",
    "datePublished": "2024-05-24T15:09:55.961Z",
    "dateReserved": "2024-05-24T15:02:54.833Z",
    "dateUpdated": "2025-05-04T12:41:41.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e6ee7abd6bfe559ad9989004b34c320fd638c526\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/229c555260cb9c1ccdab861e16f0410f1718f302\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.871Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47553\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T19:56:42.885646Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T19:57:00.241Z\"}}], \"cna\": {\"title\": \"sched/scs: Reset task stack state in bringup_cpu()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3c51d82d0b7862d7d246016c74b4390fb1fa1f11\", \"lessThan\": \"e6ee7abd6bfe559ad9989004b34c320fd638c526\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674\", \"lessThan\": \"229c555260cb9c1ccdab861e16f0410f1718f302\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674\", \"lessThan\": \"dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cb358b3ac1bb43aa8c4283830a84216dda65d39\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"24c79a7e54ccfa29fb8cbf7ed8d1e48ff1ec6e3d\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/cpu.c\", \"kernel/sched/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/cpu.c\", \"kernel/sched/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e6ee7abd6bfe559ad9989004b34c320fd638c526\"}, {\"url\": \"https://git.kernel.org/stable/c/229c555260cb9c1ccdab861e16f0410f1718f302\"}, {\"url\": \"https://git.kernel.org/stable/c/dce1ca0525bfdc8a69a9343bc714fbc19a2f04b3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched/scs: Reset task stack state in bringup_cpu()\\n\\nTo hot unplug a CPU, the idle task on that CPU calls a few layers of C\\ncode before finally leaving the kernel. When KASAN is in use, poisoned\\nshadow is left around for each of the active stack frames, and when\\nshadow call stacks are in use. When shadow call stacks (SCS) are in use\\nthe task\u0027s saved SCS SP is left pointing at an arbitrary point within\\nthe task\u0027s shadow call stack.\\n\\nWhen a CPU is offlined than onlined back into the kernel, this stale\\nstate can adversely affect execution. Stale KASAN shadow can alias new\\nstackframes and result in bogus KASAN warnings. A stale SCS SP is\\neffectively a memory leak, and prevents a portion of the shadow call\\nstack being used. Across a number of hotplug cycles the idle task\u0027s\\nentire shadow call stack can become unusable.\\n\\nWe previously fixed the KASAN issue in commit:\\n\\n  e1b77c92981a5222 (\\\"sched/kasan: remove stale KASAN poison after hotplug\\\")\\n\\n... by removing any stale KASAN stack poison immediately prior to\\nonlining a CPU.\\n\\nSubsequently in commit:\\n\\n  f1a0a376ca0c4ef1 (\\\"sched/core: Initialize the idle task with preemption disabled\\\")\\n\\n... the refactoring left the KASAN and SCS cleanup in one-time idle\\nthread initialization code rather than something invoked prior to each\\nCPU being onlined, breaking both as above.\\n\\nWe fixed SCS (but not KASAN) in commit:\\n\\n  63acd42c0d4942f7 (\\\"sched/scs: Reset the shadow stack when idle_task_exit\\\")\\n\\n... but as this runs in the context of the idle task being offlined it\u0027s\\npotentially fragile.\\n\\nTo fix these consistently and more robustly, reset the SCS SP and KASAN\\nshadow of a CPU\u0027s idle task immediately before we online that CPU in\\nbringup_cpu(). This ensures the idle task always has a consistent state\\nwhen it is running, and removes the need to so so when exiting an idle\\ntask.\\n\\nWhenever any thread is created, dup_task_struct() will give the task a\\nstack which is free of KASAN shadow, and initialize the task\u0027s SCS SP,\\nso there\u0027s no need to specially initialize either for idle thread within\\ninit_idle(), as this was only necessary to handle hotplug cycles.\\n\\nI\u0027ve tested this on arm64 with:\\n\\n* gcc 11.1.0, defconfig +KASAN_INLINE, KASAN_STACK\\n* clang 12.0.0, defconfig +KASAN_INLINE, KASAN_STACK, SHADOW_CALL_STACK\\n\\n... offlining and onlining CPUS with:\\n\\n| while true; do\\n|   for C in /sys/devices/system/cpu/cpu*/online; do\\n|     echo 0 \u003e $C;\\n|     echo 1 \u003e $C;\\n|   done\\n| done\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.83\", \"versionStartIncluding\": \"5.10.50\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.6\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.12.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.13.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T12:41:41.530Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47553\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T12:41:41.530Z\", \"dateReserved\": \"2024-05-24T15:02:54.833Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-24T15:09:55.961Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.