221 lines
11 KiB
JSON
221 lines
11 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2021-47433",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-05-21T14:58:30.830Z",
|
||
"datePublished": "2024-05-22T06:19:30.244Z",
|
||
"dateUpdated": "2026-08-05T08:47:47.653Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:47:47.653Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix abort logic in btrfs_replace_file_extents\n\nError injection testing uncovered a case where we'd end up with a\ncorrupt file system with a missing extent in the middle of a file. This\noccurs because the if statement to decide if we should abort is wrong.\n\nThe only way we would abort in this case is if we got a ret !=\n-EOPNOTSUPP and we called from the file clone code. However the\nprealloc code uses this path too. Instead we need to abort if there is\nan error, and the only error we _don't_ abort on is -EOPNOTSUPP and only\nif we came from the clone file code."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
|
||
"baseScore": 8.1,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:N - The vulnerable prealloc path is reachable remotely via NFSv4 ALLOCATE (nfsd4_allocate → vfs_fallocate → btrfs_fallocate → insert_prealloc_file_extent → btrfs_replace_file_extents) when nfsd exports a btrfs filesystem, a common server deployment.\nAC:L - An attacker who can issue fallocate/ALLOCATE against a writable btrfs file drives the vulnerable path directly; inducing a mid-drop failure (for example via memory/metadata pressure) does not require a race or other condition outside the attacker’s influence.\nPR:L - Exploitation needs only write access to a regular file on btrfs (local fallocate or an NFS write stateid); root or init-namespace capabilities are not required.\nUI:N - No victim action is needed beyond the already-mounted/exported btrfs filesystem; the attacker triggers the bug solely through fallocate/ALLOCATE.\nS:U - Impact is confined to the host kernel’s btrfs instance (on-disk corruption / filesystem disruption) and does not cross a VM, IOMMU, or other security authority boundary.\nC:N - The bug leaves missing file extent items (holes/data loss), not an out-of-bounds or UAF read primitive, so it does not disclose arbitrary kernel or other users’ data.\nI:H - On error after extents are dropped, the transaction is not aborted and can commit, producing durable filesystem corruption with missing extents in the middle of a file, which is a high integrity impact on stored data and FS metadata.\nA:H - Committed missing-extent corruption can break subsequent reads/FS operations and destabilize the shared filesystem for all users of that volume, constituting a high availability impact."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/btrfs/file.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "8fccebfa534c7984864394fa03608305e4929aae",
|
||
"lessThan": "0e32a2b85c7d92ece86c17dfef390c5ed79c6378",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "8fccebfa534c7984864394fa03608305e4929aae",
|
||
"lessThan": "0e309e1152fc34ef75991d9d69b165dbf75bf26c",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "8fccebfa534c7984864394fa03608305e4929aae",
|
||
"lessThan": "4afb912f439c4bc4e6a4f3e7547f2e69e354108f",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/btrfs/file.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "5.10",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "5.10",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.75",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.14.14",
|
||
"lessThanOrEqual": "5.14.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.10",
|
||
"versionEndExcluding": "5.10.75"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.10",
|
||
"versionEndExcluding": "5.14.14"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.10",
|
||
"versionEndExcluding": "5.15"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f"
|
||
}
|
||
],
|
||
"title": "btrfs: fix abort logic in btrfs_replace_file_extents",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-06-10T18:56:43.265826Z",
|
||
"id": "CVE-2021-47433",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-06-10T18:57:31.785Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-04T05:39:59.455Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |