Bug 1950499 (CVE-2021-3492) - CVE-2021-3492 kernel: shiftfs file system double free vulnerability
Summary: CVE-2021-3492 kernel: shiftfs file system double free vulnerability
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2021-3492
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1950503
Blocks: Embargoed1950504
TreeView+ depends on / blocked
 
Reported: 2021-04-16 18:31 UTC by Pedro Sampaio
Modified: 2021-05-03 06:09 UTC (History)
45 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw use after free (or use before allocation) in the Linux kernel Shiftfs file-system was found in the way user calls one of the few ioctls. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-04-29 12:24:10 UTC

Attachments (Terms of Use)

Description Pedro Sampaio 2021-04-16 18:31:47 UTC 
It was discovered that shiftfs, when passing through ioctls to the underlying file system, did not properly handle faults occurring during copy_from_user() correctly, leading to a double-free vulnerability or not freeing memory at all. An attacker could use this to cause a denial of service (memory consumption) or execute arbitrary code.

References:

https://www.openwall.com/lists/oss-security/2021/04/16/2
Comment 1 Pedro Sampaio 2021-04-16 18:32:58 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1950503]
Comment 2 Justin M. Forbes 2021-04-16 20:52:39 UTC 
"Shiftfs is an out-of-tree stacking file system for the Linux kernel
included in Ubuntu kernels"

Fedora does not carry this patch set.
Comment 4 Alex 2021-04-26 15:31:00 UTC 
Statement:

Shiftfs has not been accepted in the upstream Linux kernel. It is both non included to the any versions of the Red Hat Enterprise Linux.
Note You need to log in before you can comment on or make changes to this bug.