CVE-2021-46938 – This CVE describes a double-free vulnerability ... (How to Fix)

Q: What is the severity of CVE-2021-46938?

CVE-2021-46938 has a CVSS score of 7.8 (HIGH). This CVE describes a double-free vulnerability in the Linux kernel's device-mapper request-based (dm-rq) subsystem. When loading a device-mapper table fails during initialization, a subsequent device removal can trigger a double-free of kernel memory, causing a kernel panic and system crash. This affects systems using device-mapper with request-based multipath or other dm-rq configurations.

📋 TL;DR

This CVE describes a double-free vulnerability in the Linux kernel's device-mapper request-based (dm-rq) subsystem. When loading a device-mapper table fails during initialization, a subsequent device removal can trigger a double-free of kernel memory, causing a kernel panic and system crash. This affects systems using device-mapper with request-based multipath or other dm-rq configurations.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly listed, but based on commit history likely affects kernel versions before the fix commits (1cb02dc76f4c0a2749a02b26469512d6984252e9 and others).

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems using device-mapper with request-based (dm-rq) configuration, such as multipath setups. Not all Linux systems use this configuration.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to complete system crash and denial of service, potentially causing data corruption or loss in storage systems.

🟠

Likely Case

System crash when attempting to remove a device-mapper device after a failed table load, resulting in downtime.

🟢

If Mitigated

No impact if the vulnerable code path is not triggered (no failed dm-rq table loads followed by device removal).

🌐 Internet-Facing: LOW - This is a local kernel vulnerability requiring access to device-mapper operations.

🏢 Internal Only: MEDIUM - Can be triggered by privileged users or processes managing device-mapper configurations, potentially causing system-wide crashes.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering the specific error condition (failed dm-rq table load) followed by device removal. Requires privileged access to device-mapper operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 1cb02dc76f4c0a2749a02b26469512d6984252e9, 6086f957416a6e87236c06079fcaba7a3998aeca, 772b9f59657665af3b68d24d12b9d172d31f0dfb, 8ae0185255eaf05bd66f4215c81e99bf01140fd9, 8e947c8f4a5620df77e43c9c75310dc510250166

Vendor Advisory: https://git.kernel.org/stable/c/1cb02dc76f4c0a2749a02b26469512d6984252e9

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution for specific patched kernel packages. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Avoid dm-rq configurations

linux

Do not use request-based device-mapper configurations if possible

Monitor device-mapper operations

linux

Monitor for failed device-mapper table loads and avoid subsequent device removal operations

🧯 If You Can't Patch

Restrict device-mapper operations to trusted administrators only
Implement monitoring for kernel panic events and failed device-mapper operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if device-mapper request-based is in use. Look for kernel versions before the fix commits.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits. Check dmesg for absence of double-free errors during device-mapper operations.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in dmesg/system logs
'double free' or 'Oops' messages in kernel logs
Device-mapper initialization failure logs

SIEM Query:

source="kernel" AND ("double free" OR "Oops" OR "Kernel panic" OR "device-mapper.*fail")

📊 Metadata

CVE ID: CVE-2021-46938

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-415

Published: February 27, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-46938, you might also want to check these: