{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47461", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-22T06:20:56.197Z", "datePublished": "2024-05-22T06:23:22.373Z", "dateUpdated": "2026-08-05T08:47:57.329Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:47:57.329Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: fix a race between writeprotect and exit_mmap()\n\nA race is possible when a process exits, its VMAs are removed by\nexit_mmap() and at the same time userfaultfd_writeprotect() is called.\n\nThe race was detected by KASAN on a development kernel, but it appears\nto be possible on vanilla kernels as well.\n\nUse mmget_not_zero() to prevent the race as done in other userfaultfd\noperations." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached only via the local userfaultfd(2) syscall and UFFDIO_WRITEPROTECT ioctl into userfaultfd_writeprotect()/mwriteprotect_range(), not via network packet processing or physical device I/O.\nAC:L - The attacker fully controls both sides of the race by creating a userfaultfd, registering a WP range, sharing the fd (fork/SCM_RIGHTS), exiting the mm owner so exit_mmap() frees VMAs, and concurrently issuing UFFDIO_WRITEPROTECT from the fd holder.\nPR:L - Any unprivileged user can open userfaultfd with UFFD_USER_MODE_ONLY (allowed by default) and use UFFDIO_WRITEPROTECT; CAP_SYS_PTRACE is not required for this path.\nUI:N - The attacker performs the uffd setup, fd sharing, process exit, and ioctl hammering themselves; no separate victim action is required.\nS:U - This is a standard in-kernel VMA use-after-free within the host kernel authority, with no VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - The race is a use-after-free on VMA structures (KASAN-detected) while find_vma/change_protection still touch them; UAF enables reclaim/spray and arbitrary kernel memory disclosure.\nI:H - Use-after-free of VMAs during change_protection allows heap manipulation of VMA state that drives page-table writes, enabling arbitrary write and control-flow hijacking primitives.\nA:H - Concurrent exit_mmap() freeing of VMAs while mwriteprotect_range() walks and modifies them causes kernel oops/panic even when not fully exploited for code execution." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/userfaultfd.c" ], "versions": [ { "version": "63b2d4174c4ad1f40b48d7138e71bcb564c1fe03", "lessThan": "3cda4bfffd4f755645577aaa9e96a606657b4525", "status": "affected", "versionType": "git" }, { "version": "63b2d4174c4ad1f40b48d7138e71bcb564c1fe03", "lessThan": "149958ecd0627a9f1e9c678c25c665400054cd6a", "status": "affected", "versionType": "git" }, { "version": "63b2d4174c4ad1f40b48d7138e71bcb564c1fe03", "lessThan": "cb185d5f1ebf900f4ae3bf84cee212e6dd035aca", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/userfaultfd.c" ], "versions": [ { "version": "5.7", "status": "affected" }, { "version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.76", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.14.15", "lessThanOrEqual": "5.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.14.15" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3cda4bfffd4f755645577aaa9e96a606657b4525" }, { "url": "https://git.kernel.org/stable/c/149958ecd0627a9f1e9c678c25c665400054cd6a" }, { "url": "https://git.kernel.org/stable/c/cb185d5f1ebf900f4ae3bf84cee212e6dd035aca" } ], "title": "userfaultfd: fix a race between writeprotect and exit_mmap()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-47461", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-22T18:15:05.306200Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:15:25.867Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.468Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/3cda4bfffd4f755645577aaa9e96a606657b4525", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/149958ecd0627a9f1e9c678c25c665400054cd6a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/cb185d5f1ebf900f4ae3bf84cee212e6dd035aca", "tags": [ "x_transferred" ] } ] } ] } }