CVE-2021-47100: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2021-47100

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module Hi, When testing install and uninstall of ipmi_si.ko and ipmi_msghandler.ko, the system crashed. The log as follows: [ 141.087026] BUG: unable to handle kernel paging request at ffffffffc09b3a5a [ 141.087241] PGD 8fe4c0d067 P4D 8fe4c0d067 PUD 8fe4c0f067 PMD 103ad89067 PTE 0 [ 141.087464] Oops: 0010 [#1] SMP NOPTI [ 141.087580] CPU: 67 PID: 668 Comm: kworker/67:1 Kdump: loaded Not tainted 4.18.0.x86_64 #47 [ 141.088009] Workqueue: events 0xffffffffc09b3a40 [ 141.088009] RIP: 0010:0xffffffffc09b3a5a [ 141.088009] Code: Bad RIP value. [ 141.088009] RSP: 0018:ffffb9094e2c3e88 EFLAGS: 00010246 [ 141.088009] RAX: 0000000000000000 RBX: ffff9abfdb1f04a0 RCX: 0000000000000000 [ 141.088009] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 [ 141.088009] RBP: 0000000000000000 R08: ffff9abfffee3cb8 R09: 00000000000002e1 [ 141.088009] R10: ffffb9094cb73d90 R11: 00000000000f4240 R12: ffff9abfffee8700 [ 141.088009] R13: 0000000000000000 R14: ffff9abfdb1f04a0 R15: ffff9abfdb1f04a8 [ 141.088009] FS: 0000000000000000(0000) GS:ffff9abfffec0000(0000) knlGS:0000000000000000 [ 141.088009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 141.088009] CR2: ffffffffc09b3a30 CR3: 0000008fe4c0a001 CR4: 00000000007606e0 [ 141.088009] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 141.088009] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 141.088009] PKRU: 55555554 [ 141.088009] Call Trace: [ 141.088009] ? process_one_work+0x195/0x390 [ 141.088009] ? worker_thread+0x30/0x390 [ 141.088009] ? process_one_work+0x390/0x390 [ 141.088009] ? kthread+0x10d/0x130 [ 141.088009] ? kthread_flush_work_fn+0x10/0x10 [ 141.088009] ? ret_from_fork+0x35/0x40] BUG: unable to handle kernel paging request at ffffffffc0b28a5a [ 200.223240] PGD 97fe00d067 P4D 97fe00d067 PUD 97fe00f067 PMD a580cbf067 PTE 0 [ 200.223464] Oops: 0010 [#1] SMP NOPTI [ 200.223579] CPU: 63 PID: 664 Comm: kworker/63:1 Kdump: loaded Not tainted 4.18.0.x86_64 #46 [ 200.224008] Workqueue: events 0xffffffffc0b28a40 [ 200.224008] RIP: 0010:0xffffffffc0b28a5a [ 200.224008] Code: Bad RIP value. [ 200.224008] RSP: 0018:ffffbf3c8e2a3e88 EFLAGS: 00010246 [ 200.224008] RAX: 0000000000000000 RBX: ffffa0799ad6bca0 RCX: 0000000000000000 [ 200.224008] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 [ 200.224008] RBP: 0000000000000000 R08: ffff9fe43fde3cb8 R09: 00000000000000d5 [ 200.224008] R10: ffffbf3c8cb53d90 R11: 00000000000f4240 R12: ffff9fe43fde8700 [ 200.224008] R13: 0000000000000000 R14: ffffa0799ad6bca0 R15: ffffa0799ad6bca8 [ 200.224008] FS: 0000000000000000(0000) GS:ffff9fe43fdc0000(0000) knlGS:0000000000000000 [ 200.224008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 200.224008] CR2: ffffffffc0b28a30 CR3: 00000097fe00a002 CR4: 00000000007606e0 [ 200.224008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 200.224008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 200.224008] PKRU: 55555554 [ 200.224008] Call Trace: [ 200.224008] ? process_one_work+0x195/0x390 [ 200.224008] ? worker_thread+0x30/0x390 [ 200.224008] ? process_one_work+0x390/0x390 [ 200.224008] ? kthread+0x10d/0x130 [ 200.224008] ? kthread_flush_work_fn+0x10/0x10 [ 200.224008] ? ret_from_fork+0x35/0x40 [ 200.224008] kernel fault(0x1) notification starting on CPU 63 [ 200.224008] kernel fault(0x1) notification finished on CPU 63 [ 200.224008] CR2: ffffffffc0b28a5a [ 200.224008] ---[ end trace c82a412d93f57412 ]--- The reason is as follows: T1: rmmod ipmi_si. ->ipmi_unregister_smi() -> ipmi_bmc_unregister() -> __ipmi_bmc_unregister() -> kref_put(&bmc->usecount, cleanup_bmc_device); -> schedule_work(&bmc->remove_work); T2: rmmod ipmi_msghandl ---truncated---

AI Analysis

Technical Summary

CVE-2021-47100 is a use-after-free (UAF) vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem, specifically involving the ipmi_si and ipmi_msghandler kernel modules. The vulnerability manifests when these modules are installed and then uninstalled (rmmod), causing a race condition between two kernel threads. The first thread calls ipmi_unregister_smi(), which leads to ipmi_bmc_unregister(), and eventually to a kref_put() on the bmc->usecount reference count, scheduling a work item (bmc->remove_work) for cleanup. Concurrently, the second thread removes the ipmi_msghandler module. This concurrency leads to a use-after-free scenario where the kernel attempts to access memory that has already been freed, resulting in kernel paging faults and system crashes (kernel oops). The logs show invalid instruction pointer (RIP) values and kernel paging requests at freed memory addresses, confirming the UAF condition. This vulnerability affects Linux kernel versions containing the specified commit hashes (b2cfd8ab4add53c2070367bfee2f5b738f51698d) and likely other versions around that code base. The issue is triggered by module unload operations, which are common during kernel module updates or system maintenance. Although no known exploits are reported in the wild, the vulnerability can cause denial of service (DoS) through kernel crashes and potentially be leveraged for privilege escalation or arbitrary code execution by attackers with the ability to load and unload kernel modules. The vulnerability does not require user interaction but does require the ability to load/unload kernel modules, which typically requires root privileges or equivalent capabilities.

Potential Impact

For European organizations, this vulnerability poses a significant risk primarily to servers and systems running Linux kernels with the affected IPMI modules loaded. IPMI is widely used in server management for out-of-band monitoring and control, especially in data centers and enterprise environments. A successful exploitation could lead to system crashes causing denial of service, impacting critical infrastructure availability. In environments where attackers have administrative access, this vulnerability could be exploited to execute arbitrary code in kernel space, potentially leading to full system compromise. This is particularly concerning for cloud providers, hosting services, and enterprises relying on Linux-based infrastructure for critical applications. The disruption could affect service continuity, data integrity, and operational reliability. Additionally, since IPMI is often used in hardware management, exploitation could interfere with hardware monitoring and management functions, complicating incident response and recovery efforts.

Mitigation Recommendations

1. Immediate patching: Apply the latest Linux kernel updates that include the fix for CVE-2021-47100. Monitor vendor advisories for backported patches if using enterprise Linux distributions. 2. Module management: Restrict the ability to load and unload kernel modules to trusted administrators only. Use Linux Security Modules (LSMs) like SELinux or AppArmor to enforce strict policies on module operations. 3. Disable IPMI if not required: If IPMI functionality is not needed, disable or blacklist the ipmi_si and ipmi_msghandler modules to eliminate the attack surface. 4. Kernel hardening: Employ kernel lockdown features and secure boot mechanisms to prevent unauthorized kernel module loading. 5. Monitoring and alerting: Implement monitoring for kernel oops and module load/unload events to detect potential exploitation attempts early. 6. Segmentation: Isolate critical systems with IPMI enabled in secure network segments to reduce exposure to untrusted users. 7. Incident response readiness: Prepare for potential DoS incidents by having recovery procedures and backups in place to minimize downtime.