CVE-2021-47544

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix page frag corruption on page fault

Steffen reported a TCP stream corruption for HTTP requests

served by the apache web-server using a cifs mount-point

and memory mapping the relevant file.

The root cause is quite similar to the one addressed by

commit 20eb4f29b602 ("net: fix sk_page_frag() recursion from

memory reclaim"). Here the nested access to the task page frag

is caused by a page fault on the (mmapped) user-space memory

buffer coming from the cifs file.

The page fault handler performs an smb transaction on a different

socket, inside the same process context. Since sk->sk_allaction

for such socket does not prevent the usage for the task_frag,

the nested allocation modify "under the hood" the page frag

in use by the outer sendmsg call, corrupting the stream.

The overall relevant stack trace looks like the following:

httpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked:

ffffffff9146

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References