CVE-2021-46973 - Linux Kernel Vulnerability: Avoiding Potential Use After Free in MHI Send

The Linux kernel serves as the core component of the Linux operating system. It is responsible for managing the system's resources, providing low-level hardware interfaces, and enabling communication between processes and hardware devices. As such, it is critical that the Linux kernel remains secure and free of vulnerabilities.

Recently, the Linux kernel team has resolved a vulnerability with the CVE-2021-46973 identifier. This security issue was found within the network (net) subsystem's Qualcomm IPC Router (qrtr) module and relates to the handling of skb (sk_buff - socket buffer) within the Mobile High-Definition Link (MHI) send functionality. Without proper handling, it can lead to a potential use-after-free scenario with the sk_buff structure, causing system instability, denial of service, or possibly remote code execution.

In this article, we discuss the details of this vulnerability, its implications, and the steps taken to address it in the Linux kernel. Additionally, we provide original references and code snippets to offer a clear understanding of the issue and its solution.

Exploit Details

The vulnerability lies in how the Linux kernel's net subsystem handles the MHI ul_callback function when invoked immediately after queueing an skb for transmission. The callback function is responsible for decrementing the refcount of the associated socket (sk) and freeing the skb. However, if the ul_callback is invoked before updating the sk refcount and the skb is dereferenced, it can lead to use-after-free issues and potentially drop the sk's last refcount.

This use-after-free issue can allow an attacker to exploit the vulnerability, leading to unpredictable system behavior, memory corruption, or even remote code execution. The CVE-2021-46973 vulnerability is particularly concerning since it exists within the core Linux kernel, posing a risk not just to the Linux operating system but also to any other devices built on top of the kernel.

The following code snippet demonstrates the vulnerability in question

static void qrtr_mhi_ul_callback(struct mhi_device *mhi_dev, struct mhi_result *result)
{
	struct sk_buff *skb = result->buf_addr;
	struct sock *sk = skb->sk;

	atomic_dec(&sk->sk_wmem_alloc);
	skb->sk = NULL;
	consume_skb(skb);
}

Resolution

To resolve the issue, the Linux kernel developers have implemented a fix in which the dereference of skb and the increment of the sk refcount must happen before the skb is queued. This ensures that the vulnerability cannot be exploited, and there are no use-after-free situations or potential drops in the sk refcount.

The following code snippet shows the updated function with the fix applied

static void qrtr_mhi_ul_callback(struct mhi_device *mhi_dev, struct mhi_result *result)
{
	struct sk_buff *skb = result->buf_addr;
	struct sock *sk;

	local_bh_disable();
	sk = skb->sk;
	atomic_dec(&sk->sk_wmem_alloc);
	skb->sk = NULL;
	consume_skb(skb);
	local_bh_enable();
}

To address this vulnerability, users should ensure that they are using the latest version of the Linux kernel with the appropriate patches applied.

Original References

- Linux Kernel Git Commit for the fix
- Linux Kernel Mailing List Discussion

Conclusion

The CVE-2021-46973 vulnerability highlights the need for continued vigilance in identifying and addressing potential security issues within widely-used open-source projects such as the Linux kernel. As a vital component of numerous devices and systems, it is essential to ensure that the Linux kernel remains secure and up-to-date against vulnerabilities. By keeping an eye on such exploits and applying fixes as soon as possible, we can contribute to a safer and more robust technology ecosystem.

Timeline

Published on: 02/27/2024 19:04:07 UTC
Last modified on: 02/28/2024 14:06:45 UTC