CVE-2021-46958

published 2024-02-27

CVE-2021-46958: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between transaction aborts and fsyncs leading to use-after-free There is a…

Priority P4 17 medium 4.7 CVSS 3.1

AV L AC H PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race between transaction aborts and fsyncs leading to use-after-free

There is a race between a task aborting a transaction during a commit,
a task doing an fsync and the transaction kthread, which leads to an
use-after-free of the log root tree. When this happens, it results in a
stack trace like the following:

BTRFS info (device dm-0): forced readonly
BTRFS warning (device dm-0): Skipping commit of aborted transaction.
BTRFS: error (device dm-0) in cleanup_transaction:1958: errno=-5 IO failure
BTRFS warning (device dm-0): lost page write due to IO error on /dev/mapper/error-test (-5)
BTRFS warning (device dm-0): Skipping commit of aborted transaction.
BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0xa4e8 len 4096 err no 10
BTRFS error (device dm-0): error writing primary super block to device 1
BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0x12e000 len 4096 err no 10
BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0x12e008 len 4096 err no 10
BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0x12e010 len 4096 err no 10
BTRFS: error (device dm-0) in write_all_supers:4110: errno=-5 IO failure (1 errors while writing supers)
BTRFS: error (device dm-0) in btrfs_sync_log:3308: errno=-5 IO failure
general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b68: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI
CPU: 2 PID: 2458471 Comm: fsstress Not tainted 5.12.0-rc5-btrfs-next-84 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:__mutex_lock+0x139/0xa40
Code: c0 74 19 (...)
RSP: 0018:ffff9f18830d7b00 EFLAGS: 00010202
RAX: 6b6b6b6b6b6b6b68 RBX: 0000000000000001 RCX: 0000000000000002
RDX: ffffffffb9c54d13 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff9f18830d7bc0 R08: 0000000000000000 R09: 0000000000000000
R10: ffff9f188

Affected

13 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.10.38-1 (bookworm)	linux 5.10.38-1 (bookworm)
linux	linux	—	—
linux	linux	>= ef67963dac255b293e19815ea3d440567be4626f < a4794be7b00b7eda4b45fffd283ab7d76df7e5d6	a4794be7b00b7eda4b45fffd283ab7d76df7e5d6
linux	linux	>= ef67963dac255b293e19815ea3d440567be4626f < 633f7f216663587f17601eaa1cf2ac3d5654874c	633f7f216663587f17601eaa1cf2ac3d5654874c
linux	linux	>= ef67963dac255b293e19815ea3d440567be4626f < e2da98788369bfba1138bada72765c47989a4338	e2da98788369bfba1138bada72765c47989a4338
linux	linux	>= ef67963dac255b293e19815ea3d440567be4626f < 061dde8245356d8864d29e25207aa4daa0be4d3c	061dde8245356d8864d29e25207aa4daa0be4d3c
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 5.11 < 5.11.20	5.11.20
linux	linux_kernel	>= 5.12 < 5.12.3	5.12.3
linux	linux_kernel	>= 5.7 < 5.10.36	5.10.36

CVSS provenance

nvd v3.1 4.7 MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 4.7 MEDIUM

vendor_debian 4.7 MEDIUM

vendor_redhat 4.7 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416