CVE-2021-47214 in Linux
Summary
by MITRE • 04/10/2024
In the Linux kernel, the following vulnerability has been resolved:
hugetlb, userfaultfd: fix reservation restore on userfaultfd error
Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we bail out using "goto out_release_unlock;" in the cases where idx >= size, or !huge_pte_none(), the code will detect that new_pagecache_page == false, and so call restore_reserve_on_error(). In this case I see restore_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h->resv_hugepages causing a 100% reproducible leak.
We should treat the is_continue case similar to adding a page into the pagecache and set new_pagecache_page to true, to indicate that there is no reservation to restore on the error path, and we need not call restore_reserve_on_error(). Rename new_pagecache_page to page_in_pagecache to make that clear.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/28/2025
The vulnerability described in CVE-2021-47214 represents a critical memory management flaw within the Linux kernel's huge page handling subsystem, specifically affecting the interaction between huge page transparent huge pages and userfaultfd mechanisms. This issue resides in the hugetlb_mcopy_atomic_pte() function where improper error handling leads to resource leakage during page fault processing. The vulnerability manifests when the kernel attempts to manage huge pages through userfaultfd operations, creating a scenario where reservation accounting becomes inconsistent due to flawed conditional logic in the error recovery path.
The technical root cause stems from incorrect state management within the is_continue case of the hugetlb_mcopy_atomic_pte() function. When error conditions occur such as idx >= size or huge_pte_none() evaluation failing, the code executes a goto out_release_unlock path that incorrectly determines new_pagecache_page == false. This triggers the restore_reserve_on_error() function which unconditionally removes page reservations from the system. However, this cleanup operation conflicts with subsequent calls to remove_inode_hugepages() that increment the h->resv_hugepages counter, creating a direct memory leak where reservation counts become inconsistent and resources remain allocated indefinitely.
The operational impact of this vulnerability extends beyond simple memory leakage to potentially compromise system stability and resource availability. Attackers could exploit this flaw to gradually consume system memory resources through repeated triggering of the error path, leading to system performance degradation or even denial of service conditions. The 100% reproducibility of this issue makes it particularly dangerous as it can be consistently triggered under specific memory management workloads involving huge pages and userfaultfd operations.
This vulnerability maps directly to CWE-401: Improper Release of Memory Before Next Processing, and exhibits characteristics consistent with ATT&CK technique T1490: Inhibit System Recovery, as it creates persistent resource leaks that can degrade system functionality. The fix implemented addresses the core issue by modifying the page reservation state handling to properly distinguish between cases where pages are actually added to the page cache versus cases where reservations need restoration. The solution involves renaming the new_pagecache_page variable to page_in_pagecache to better reflect its semantic meaning and ensuring that the error recovery path correctly identifies when no reservation restoration is needed, thereby preventing the double accounting that leads to the leak.
The mitigation strategy requires applying the kernel patch that modifies the hugetlb_mcopy_atomic_pte() function to properly handle the reservation state in error conditions. System administrators should prioritize updating their kernel versions to include this fix, particularly on systems that heavily utilize huge pages and userfaultfd mechanisms. The fix ensures that when errors occur during huge page operations, the reservation accounting remains consistent and prevents the accumulation of leaked reservations that could eventually exhaust available memory resources. This vulnerability highlights the complexity of memory management in kernel space and the critical importance of proper state handling in concurrent systems where multiple components interact through shared data structures.