Bug 1950499 (CVE-2021-3492) - CVE-2021-3492 kernel: shiftfs file system double free vulnerability
Summary: CVE-2021-3492 kernel: shiftfs file system double free vulnerability
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2021-3492
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1950503
Blocks: 1950504
TreeView+ depends on / blocked
 
Reported: 2021-04-16 18:31 UTC by Pedro Sampaio
Modified: 2021-05-03 06:09 UTC (History)
45 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-04-29 12:24:10 UTC
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2021-04-16 18:31:47 UTC 
It was discovered that shiftfs, when passing through ioctls to the underlying file system, did not properly handle faults occurring during copy_from_user() correctly, leading to a double-free vulnerability or not freeing memory at all. An attacker could use this to cause a denial of service (memory consumption) or execute arbitrary code.

References:

https://www.openwall.com/lists/oss-security/2021/04/16/2
Comment 1 Pedro Sampaio 2021-04-16 18:32:58 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1950503]
Comment 2 Justin M. Forbes 2021-04-16 20:52:39 UTC 
"Shiftfs is an out-of-tree stacking file system for the Linux kernel
included in Ubuntu kernels"

Fedora does not carry this patch set.
Comment 4 Alex 2021-04-26 15:31:00 UTC 
Statement:

Shiftfs has not been accepted in the upstream Linux kernel. It is both non included to the any versions of the Red Hat Enterprise Linux.
Note You need to log in before you can comment on or make changes to this bug.