Cloudanix VulnDB

CVE-2021-47044

None

CVSS

—

EPSS

0.3%

Published

Feb 28, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux decides which tasks run on which processors can make computers crash when certain unusual workload patterns occur.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Shift-out-of-bounds undefined behavior in Linux kernel sched/fair load_balance when nr_balance_failed exceeds cache_nice_tries + 3 without proper capping of the shift exponent.

Why it matters to the business

Linux systems may experience unexpected crashes, instability, or denial of service under sustained scheduler load-balancing pressure, affecting uptime and availability.

How an attack unfolds

An attacker induces repeated failed load_balance attempts to inflate nr_balance_failed, bypassing the active-balance reset path and forcing a shift with an exponent larger than the operand width, triggering undefined behavior that can crash the kernel.

How to fix it

Apply the upstream fix that caps the shift exponent to BITS_PER_TYPE(typeof(left)) - 1 in sched/fair.c; rebuild and deploy updated kernels across all affected Linux distributions.

How to confirm the fix worked

Inspect kernel source or running binary for the added exponent cap; reproduce syzbot-reported high nr_balance_failed values and confirm they no longer trigger out-of-bounds shifts or crashes.

Typical attack path

  1. Craft or trigger workloads causing repeated load_balance failures on the target CPU set
  2. Increment nr_balance_failed past the active-balance threshold without reset
  3. Force the oversized shift operation to invoke undefined behavior
  4. Leverage resulting kernel fault for denial of service or further exploitation

How to detect it

Search kernel logs and scheduler tracepoints for repeated load_balance failures accompanied by extremely large nr_balance_failed values or shift-related warnings.

What your security team should do

  • Prioritize kernel updates on all production Linux hosts
  • Enable scheduler debugging and monitor for anomalous nr_balance_failed growth
  • Test patched kernels in staging before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix shift-out-of-bounds in load_balance() Syzbot reported a handful of occurrences where an sd->nr_balance_failed can grow to much higher values than one would expect. A successful load_balance() resets it to 0; a failed one increments it. Once it gets to sd->cache_nice_tries + 3, this *should* trigger an active balance, which will either set it to sd->cache_nice_tries+1 or reset it to 0. However, in case the to-be-active-balanced task is not allowed to run on env->dst_cpu, then the increment is done without any further modification. This could then be repeated ad nauseam, and would explain the absurdly high values reported by syzbot (86, 149). VincentG noted there is value in letting sd->cache_nice_tries grow, so the shift itself should be fixed. That means preventing: """ If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined. """ Thus we need to cap the shift exponent to BITS_PER_TYPE(typeof(lefthand)) - 1. I had a look around for other similar cases via coccinelle: @expr@ position pos; expression E1; expression E2; @@ ( E1 >> E2@pos | E1 >> E2@pos ) @cst depends on expr@ position pos; expression expr.E1; constant cst; @@ ( E1 >> cst@pos | E1 << cst@pos ) @script:python depends on !cst@ pos << expr.pos; exp << expr.E2; @@ # Dirty hack to ignore constexpr if exp.upper() != exp: coccilib.report.print_report(pos[0], "Possible UB shift here") The only other match in kernel/sched is rq_clock_thermal() which employs sched_thermal_decay_shift, and that exponent is already capped to 10, so that one is fine.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 5.10.38-1
Debian:12 linux 0 5.10.38-1
Debian:13 linux 0 5.10.38-1
SUSE:Enterprise Storage 7.1 kernel-64kb 0 5.3.18-150300.59.158.1
SUSE:Enterprise Storage 7.1 kernel-default 0 5.3.18-150300.59.158.1
SUSE:Enterprise Storage 7.1 kernel-default-base 0 5.3.18-150300.59.158.1.150300.18.92.5
SUSE:Enterprise Storage 7.1 kernel-docs 0 5.3.18-150300.59.158.1
SUSE:Enterprise Storage 7.1 kernel-obs-build 0 5.3.18-150300.59.158.1
SUSE:Enterprise Storage 7.1 kernel-preempt 0 5.3.18-150300.59.158.1
SUSE:Enterprise Storage 7.1 kernel-source 0 5.3.18-150300.59.158.1
SUSE:Enterprise Storage 7.1 kernel-syms 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise High Availability Extension 15 SP3 kernel-default 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-64kb 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-default 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-default-base 0 5.3.18-150300.59.158.1.150300.18.92.5
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-docs 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-obs-build 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-preempt 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-source 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-syms 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Live Patching 15 SP3 kernel-default 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_43 0 1-150300.7.3.5
SUSE:Linux Enterprise Micro 5.1 kernel-default 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Micro 5.1 kernel-default-base 0 5.3.18-150300.59.158.1.150300.18.92.5
SUSE:Linux Enterprise Micro 5.1 kernel-rt 0 5.3.18-150300.166.1
SUSE:Linux Enterprise Micro 5.1 kernel-source-rt 0 5.3.18-150300.166.1
SUSE:Linux Enterprise Micro 5.2 kernel-default 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Micro 5.2 kernel-default-base 0 5.3.18-150300.59.158.1.150300.18.92.5
SUSE:Linux Enterprise Micro 5.2 kernel-rt 0 5.3.18-150300.166.1
SUSE:Linux Enterprise Micro 5.2 kernel-source-rt 0 5.3.18-150300.166.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-64kb 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-default 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-default-base 0 5.3.18-150300.59.158.1.150300.18.92.5
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-docs 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-obs-build 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-preempt 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-source 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-syms 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-zfcpdump 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-default 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-default-base 0 5.3.18-150300.59.158.1.150300.18.92.5
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-docs 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-obs-build 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-preempt 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-source 0 5.3.18-150300.59.158.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-syms 0 5.3.18-150300.59.158.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 5.4.0-9.12
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1014.18~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1006.6
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1007.8~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1019.24~20.04.1.1
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1007.10
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1006.9~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 5.4.0-1008.9
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1003.5~20.04.2
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1003.4
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1003.5~20.04.1
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1001.3
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1004.4
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1007.9~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1007.7
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1015.17~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1020.24
Ubuntu:22.04:LTS linux 0 5.13.0-19.19
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 6.5.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-azure 0 5.13.0-1006.7
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 6.5.0-1007.7~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1019.24.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 6.5.0-1010.10~22.04.3
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 6.5.0-14.14~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-kvm 0 5.13.0-1004.4
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-22.22
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 6.5.0-14.14.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 6.5.0-1004.4
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 6.1.0-1004.4
Ubuntu:22.04:LTS linux-oem-6.5 0 6.5.0-1003.3
Ubuntu:22.04:LTS linux-oracle 0 5.13.0-1008.10
Ubuntu:22.04:LTS linux-oracle-6.5 0 6.5.0-1013.13~22.04.4
Ubuntu:22.04:LTS linux-raspi 0 5.13.0-1008.9
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 6.5.0-17.17.1.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 6.5.0-1007.8~22.04.1
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 5.15.0-1022.26
Ubuntu:24.04:LTS linux 0 6.5.0-9.9
Ubuntu:24.04:LTS linux-aws 0 6.5.0-1008.8
Ubuntu:24.04:LTS linux-azure 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gcp 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1003.5
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1001.3
Ubuntu:24.04:LTS linux-ibm 0 6.5.0-1009.9
Ubuntu:24.04:LTS linux-lowlatency 0 6.5.0-9.9.1
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1007.7
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1009.9.1
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1003.3
Ubuntu:24.04:LTS linux-oracle 0 6.5.0-1010.10
Ubuntu:24.04:LTS linux-raspi 0 6.5.0-1005.7
Ubuntu:24.04:LTS linux-riscv 0 6.5.0-9.9.1
Ubuntu:Pro:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:Pro:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-hwe 0 No fix
Ubuntu:Pro:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-oem 0 No fix
Ubuntu:Pro:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-gke 0 No fix

Related vulnerabilities