CVE-2021-47238 in Linux
Summary
by MITRE • 05/21/2024
In the Linux kernel, the following vulnerability has been resolved:
net: ipv4: fix memory leak in ip_mc_add1_src
BUG: memory leak unreferenced object 0xffff888101bc4c00 (size 32): comm "syz-executor527", pid 360, jiffies 4294807421 (age 19.329s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01 00 00 00 00 00 00 00 ac 14 14 bb 00 00 02 00 ................ backtrace: [] kmalloc include/linux/slab.h:558 [inline]
[] kzalloc include/linux/slab.h:688 [inline]
[] ip_mc_add1_src net/ipv4/igmp.c:1971 [inline]
[] ip_mc_add_src+0x95f/0xdb0 net/ipv4/igmp.c:2095
[] ip_mc_source+0x84c/0xea0 net/ipv4/igmp.c:2416
[] do_ip_setsockopt net/ipv4/ip_sockglue.c:1294 [inline]
[] ip_setsockopt+0x114b/0x30c0 net/ipv4/ip_sockglue.c:1423
[] raw_setsockopt+0x13d/0x170 net/ipv4/raw.c:857
[] __sys_setsockopt+0x158/0x270 net/socket.c:2117
[] __do_sys_setsockopt net/socket.c:2128 [inline]
[] __se_sys_setsockopt net/socket.c:2125 [inline]
[] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2125
[] do_syscall_64+0x40/0x80 arch/x86/entry/common.c:47
[] entry_SYSCALL_64_after_hwframe+0x44/0xae
In commit 24803f38a5c0 ("igmp: do not remove igmp souce list info when set link down"), the ip_mc_clear_src() in ip_mc_destroy_dev() was removed, because it was also called in igmpv3_clear_delrec().
Rough callgraph:
inetdev_destroy -> ip_mc_destroy_dev -> igmpv3_clear_delrec -> ip_mc_clear_src -> RCU_INIT_POINTER(dev->ip_ptr, NULL)
However, ip_mc_clear_src() called in igmpv3_clear_delrec() doesn't release in_dev->mc_list->sources. And RCU_INIT_POINTER() assigns the NULL to dev->ip_ptr. As a result, in_dev cannot be obtained through inetdev_by_index() and then in_dev->mc_list->sources cannot be released by ip_mc_del1_src() in the sock_close. Rough call sequence goes like:
sock_close -> __sock_release -> inet_release -> ip_mc_drop_socket -> inetdev_by_index -> ip_mc_leave_src -> ip_mc_del_src -> ip_mc_del1_src
So we still need to call ip_mc_clear_src() in ip_mc_destroy_dev() to free in_dev->mc_list->sources.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/21/2024
The vulnerability described in CVE-2021-47238 represents a memory leak within the Linux kernel's Internet Group Management Protocol implementation, specifically affecting the IPv4 multicast functionality. This issue occurs in the net/ipv4/igmp.c file where the ip_mc_add1_src function fails to properly release memory allocated for multicast source tracking structures. The leak manifests when a network device is destroyed and the associated multicast source information remains unreleased, leading to a gradual accumulation of unreferenced memory blocks that cannot be reclaimed by the system's memory management subsystem.
The technical flaw stems from a change in commit 24803f38a5c0 that removed the ip_mc_clear_src() function call from ip_mc_destroy_dev() because it was believed to be redundant since the same function was invoked within igmpv3_clear_delrec(). However, this optimization introduced a critical oversight where the actual cleanup of multicast source entries stored in in_dev->mc_list->sources was not properly executed. The removal of this cleanup call means that when a network device is destroyed, the memory allocated for tracking multicast sources becomes orphaned and inaccessible through normal cleanup pathways, creating a persistent memory leak that grows with each device destruction and recreation cycle.
The operational impact of this memory leak extends beyond simple resource consumption, potentially leading to system instability and performance degradation over time. The vulnerability can be triggered through socket operations that manipulate multicast group membership, particularly when setting socket options related to multicast source filtering. Attackers could potentially exploit this by repeatedly creating and destroying network interfaces or by manipulating multicast socket configurations, causing the system to gradually consume available memory resources. This type of resource leak can ultimately result in system crashes, denial of service conditions, or degraded performance in systems handling high volumes of multicast traffic.
The memory leak is classified under CWE-401 as "Improper Release of Memory Before Removing Last Reference" and aligns with ATT&CK technique T1490 "Inhibit System Recovery" through resource exhaustion. The vulnerability exists in the kernel's network stack and specifically affects systems running Linux kernels that include the problematic commit. The leak occurs during device destruction and cleanup operations, making it particularly relevant to systems that frequently create and destroy network interfaces or handle dynamic network configurations. Mitigation strategies include applying the kernel patch that restores the ip_mc_clear_src() call in ip_mc_destroy_dev(), which ensures proper cleanup of multicast source tracking structures during device destruction. Additionally, system administrators should monitor memory usage patterns and implement appropriate resource limits to detect and prevent potential exploitation of this vulnerability through memory exhaustion attacks.