Security tracker / CVE-2021-4023

CVE-2021-4023

io-wq: fix cancellation on create-worker failure

References

• Debian security tracker
• cve.org
• https://bugzilla.redhat.com/show_bug.cgi?id=2026484
• https://git.kernel.dk/cgit/linux-block/commit/?h=io_uring-5.15&id=713b9825a4c47897f66ad69409581e7734a8728e
• https://lkml.org/lkml/2021/9/8/64

Notes

 bwh> It's unclear to me whether this was introduced in 5.15-rc1 by commit
 bwh> 3146cba99aa2 "io-wq: make worker creation resilient against signals"
 bwh> or whether the issue already existed and both commits were needed to
 bwh> fix it.

Bugs

Status

Branch	Status
upstream	released (5.15-rc1) [713b9825a4c47897f66ad69409581e7734a8728e]
6.18-upstream-stable
6.17-upstream-stable
6.12-upstream-stable
6.6-upstream-stable
6.1-upstream-stable	N/A "Fixed before branch point"
5.10-upstream-stable
4.19-upstream-stable	N/A "Vulnerable code introduced later"
4.9-upstream-stable	N/A "Vulnerable code introduced later"
sid	released (5.15.3-1)
6.12-trixie-security
6.1-bookworm-security	N/A "Fixed before branch point"
5.10-bullseye-security
4.19-buster-security	N/A "Vulnerable code introduced later"
4.9-stretch-security	N/A "Vulnerable code introduced later"