CVE-2021-47275

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bcache: avoid oversized read request in cache missing code path

In the cache missing code path of cached device, if a proper location

from the internal B+ tree is matched for a cache miss range, function

cached_dev_cache_miss() will be called in cache_lookup_fn() in the

following code block,

[code block 1]

526 unsigned int sectors = KEY_INODE(k) == s->iop.inode

527 ? min_t(uint64_t, INT_MAX,

528 KEY_START(k) - bio->bi_iter.bi_sector)

529 : INT_MAX;

530 int ret = s->d->cache_miss(b, s, bio, sectors);

Here s->d->cache_miss() is the call backfunction pointer initialized as

cached_dev_cache_miss(), the last parameter 'sectors' is an important

hint to calculate the size of read request to backing device of the

missing cache data.

Current calculation in above code block may generate oversized value of

'sectors', which consequently may trigg

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References