CVE-2021-47635

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ubifs: Fix to add refcount once page is set private

MM defined the rule [1] very clearly that once page was set with PG_private

flag, we should increment the refcount in that page, also main flows like

pageout(), migrate_page() will assume there is one additional page

reference count if page_has_private() returns true. Otherwise, we may

get a BUG in page migration:

page:0000000080d05b9d refcount:-1 mapcount:0 mapping:000000005f4d82a8

index:0xe2 pfn:0x14c12

aops:ubifs_file_address_operations [ubifs] ino:8f1 dentry name:"f30e"

flags: 0x1fffff80002405(locked|uptodate|owner_priv_1|private|node=0|

zone=1|lastcpupid=0x1fffff)

page dumped because: VM_BUG_ON_PAGE(page_count(page) != 0)

------------[ cut here ]------------

kernel BUG at include/linux/page_ref.h:184!

invalid opcode: 0000 [#1] SMP

CPU: 3 PID: 38 Comm: kcompactd0 Not tainted 5.15.0-rc5

RIP: 0010:migrate_page_move_mapping+0xac3/0xe70

Call

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References