412 lines
20 KiB
JSON
412 lines
20 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2021-47254",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-04-10T18:59:19.539Z",
|
|
"datePublished": "2024-05-21T14:19:49.475Z",
|
|
"dateUpdated": "2026-08-05T08:46:59.624Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T08:46:59.624Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in gfs2_glock_shrink_scan\n\nThe GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to\nremove the glock from the lru list in __gfs2_glock_put().\n\nOn the shrink scan path, the same flag is cleared under lru_lock but because\nof cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the\nput side can be made without deleting the glock from the lru list.\n\nKeep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to\nensure correct behavior on both sides - clear GLF_LRU after list_del under\nlru_lock."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable path is the local GFS2 glock LRU shrinker and glock put path, reached via local filesystem operations and memory reclaim on a mounted GFS2 volume, not via network packet processing.\nAC:L - An attacker can induce both sides of the race by churning inode/iopen/flock glocks onto the LRU through ordinary file operations while concurrently creating memory pressure to force gfs2_glock_shrink_scan and dispose.\nPR:L - On a multi-user GFS2 deployment the filesystem is already mounted; an unprivileged local user with access to that mount can trigger glock get/put and reclaim without CAP_SYS_ADMIN.\nUI:N - No separate victim action is required; the attacker triggers the race through their own filesystem activity and memory allocation once GFS2 is available.\nS:U - This is a standard in-kernel use-after-free enabling privilege escalation within the same host security authority, not a VM/IOMMU/sandbox boundary crossing.\nC:H - Use-after-free of a slab-allocated gfs2_glock (aspace) object allows reclaim of attacker-controlled contents and arbitrary kernel memory disclosure primitives.\nI:H - The same UAF enables heap spraying and corruption of the freed glock object, providing arbitrary write / control-flow hijacking potential in the kernel.\nA:H - The bug manifests as a kernel use-after-free during list_del in gfs2_dispose_glock_lru (observed under KASAN), which can oops/panic and deny service."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/gfs2/glock.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6948c6bc17d666663a84c124b3176039e64a58f4",
|
|
"lessThan": "38ce329534500bf4ae71f81df6a37a406cf187b4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b568ed385a18c0ddbe41862b69088b636550a04f",
|
|
"lessThan": "92869945cc5b78ee8a1ef90336fe070893e3458a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "762bb3528249604bc680a9df635e8995740176de",
|
|
"lessThan": "0364742decb0f02bc183404868b82896f7992595",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bac8520892812dada1ac93f27d96317470d24b1f",
|
|
"lessThan": "094bf5670e762afa243d2c41a5c4ab71c7447bf4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "7881ef3f33bb80f459ea6020d1e021fc524a6348",
|
|
"lessThan": "86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "7881ef3f33bb80f459ea6020d1e021fc524a6348",
|
|
"lessThan": "a61156314b66456ab6a291ed5deba1ebd002ab3c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "7881ef3f33bb80f459ea6020d1e021fc524a6348",
|
|
"lessThan": "e87ef30fe73e7e10d2c85bdcc778dcec24dca553",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "7881ef3f33bb80f459ea6020d1e021fc524a6348",
|
|
"lessThan": "1ab19c5de4c537ec0d9b21020395a5b5a6c059b2",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1e7a416fb765c9072479dc424780c0937ba99270",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "dcbdbe13796ffa561510d2686a6318564e728bbd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4.4.181",
|
|
"lessThan": "4.4.274",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.9.180",
|
|
"lessThan": "4.9.274",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.14.123",
|
|
"lessThan": "4.14.238",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.19.47",
|
|
"lessThan": "4.19.196",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.0.20",
|
|
"lessThan": "5.1",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.1.6",
|
|
"lessThan": "5.2",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/gfs2/glock.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.4.274",
|
|
"lessThanOrEqual": "4.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.9.274",
|
|
"lessThanOrEqual": "4.9.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.14.238",
|
|
"lessThanOrEqual": "4.14.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.19.196",
|
|
"lessThanOrEqual": "4.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.127",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.45",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.12.12",
|
|
"lessThanOrEqual": "5.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.13",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.4.181",
|
|
"versionEndExcluding": "4.4.274"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.9.180",
|
|
"versionEndExcluding": "4.9.274"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.14.123",
|
|
"versionEndExcluding": "4.14.238"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.19.47",
|
|
"versionEndExcluding": "4.19.196"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "5.4.127"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "5.10.45"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "5.12.12"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "5.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0.20"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.1.6"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2"
|
|
}
|
|
],
|
|
"title": "gfs2: Fix use-after-free in gfs2_glock_shrink_scan",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2024-06-17T17:37:55.520472Z",
|
|
"id": "CVE-2021-47254",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-06-17T17:39:42.605Z"
|
|
}
|
|
},
|
|
{
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2024-08-04T05:32:07.867Z"
|
|
},
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |