Spinlock Recursion Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2021-47632: In the Linux kernel, the following vulnerability has been resolved: powerpc/set_memory: Avoid spinlock recursion in change_page_attr() Commit 1f9ad21c3b38 ("powerpc/mm: Implement set_memory() routines") included a spin_l... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. This vulnerability specifically affects the memory management routines in the PowerPC architecture of the Linux kernel, which can lead to system instability and potential security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-47632, arises from a spinlock recursion issue in the change_page_attr() function within the Linux kernel's memory management subsystem. This flaw was introduced during the implementation of the set_memory() routines, where a spin_lock() was added to ensure safe operations. However, subsequent modifications intended to address concurrent access led to a situation where spinlock recursion could occur, resulting in potential deadlocks and system crashes. The vulnerability can be exploited under specific conditions, particularly when multiple threads attempt to modify memory attributes concurrently, leading to unpredictable behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available for their respective Debian versions.
Conclusion
CVE-2021-47632 is a significant vulnerability in the Linux kernel affecting Debian packages, particularly in the PowerPC architecture. Users are encouraged to update their systems to the patched version to mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47632 is a vulnerability in the Linux kernel that involves spinlock recursion in the change_page_attr() function, potentially leading to system instability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
The consequences include system crashes, deadlocks, and unpredictable behavior when multiple threads attempt to modify memory attributes concurrently.
Yes, a patch is available for Debian 12 and 13 in version 5.17.3-1. Users of Debian 11 should monitor for updates.
If you cannot update immediately, it is advisable to monitor your system for unusual behavior and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
