CVE-2021-47406
published 2024-05-21CVE-2021-47406: In the Linux kernel, the following vulnerability has been resolved: ext4: add error checking to ext4_ext_replay_set_iblocks() If the call to ext4_map_blocks()…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
ext4: add error checking to ext4_ext_replay_set_iblocks()
If the call to ext4_map_blocks() fails due to an corrupted file
system, ext4_ext_replay_set_iblocks() can get stuck in an infinite
loop. This could be reproduced by running generic/526 with a file
system that has inline_data and fast_commit enabled. The system will
repeatedly log to the console:
EXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076
and the stack that it gets stuck in is:
ext4_block_to_path+0xe3/0x130
ext4_ind_map_blocks+0x93/0x690
ext4_map_blocks+0x100/0x660
skip_hole+0x47/0x70
ext4_ext_replay_set_iblocks+0x223/0x440
ext4_fc_replay_inode+0x29e/0x3b0
ext4_fc_replay+0x278/0x550
do_one_pass+0x646/0xc10
jbd2_journal_recover+0x14a/0x270
jbd2_journal_load+0xc4/0x150
ext4_load_journal+0x1f3/0x490
ext4_fill_super+0x22d4/0x2c00
With this patch, generic/526 still fails, but system is no longer
locking up in a tight loop. It's likely the root casue is that
fast_commit replay is corrupting file systems with inline_data, and we
probably need to add better error handling in the fast commit replay
code path beyond what is done here, which essentially just breaks the
infinite loop without reporting the to the higher levels of the code.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.12-1 (bookworm) | linux 5.14.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 < a63474dbf692dd09b50fed592bc41f6de5f102fc | a63474dbf692dd09b50fed592bc41f6de5f102fc |
| linux | linux | >= 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 < 27e10c5d31ff1d222c7f797f1ee96d422859ba67 | 27e10c5d31ff1d222c7f797f1ee96d422859ba67 |
| linux | linux | >= 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 < 1fd95c05d8f742abfe906620780aee4dbe1a2db0 | 1fd95c05d8f742abfe906620780aee4dbe1a2db0 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.84-1 | 5.10.84-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 5.10 < 5.10.71 | 5.10.71 |
| linux | linux_kernel | >= 5.11 < 5.14.10 | 5.14.10 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: ext4: add error checking to ext4_ext_replay_set_iblocks()
vendor_redhat·2024-05-21·CVSS 5.5
CVE-2021-47406 [MEDIUM] CWE-835 kernel: ext4: add error checking to ext4_ext_replay_set_iblocks()
kernel: ext4: add error checking to ext4_ext_replay_set_iblocks()
In the Linux kernel, the following vulnerability has been resolved:
ext4: add error checking to ext4_ext_replay_set_iblocks()
If the call to ext4_map_blocks() fails due to an corrupted file
system, ext4_ext_replay_set_iblocks() can get stuck in an infinite
loop. This could be reproduced by running generic/526 with a file
system that has inline_data and fast_commit enabled. The system will
repeatedly log to the console:
EXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076
and the stack that it gets stuck in is:
ext4_block_to_path+0xe3/0x130
ext4_ind_map_blocks+0x93/0x690
ext4_map_blocks+0x100/0x660
skip_hole+0x47/0x70
ext4_ext_replay_set_iblocks+0x223/0x440
ext4_fc_replay_inode+0x29e/
Debian
CVE-2021-47406: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: add e...
vendor_debian·2021·CVSS 5.5
CVE-2021-47406 [MEDIUM] CVE-2021-47406: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: add e...
In the Linux kernel, the following vulnerability has been resolved: ext4: add error checking to ext4_ext_replay_set_iblocks() If the call to ext4_map_blocks() fails due to an corrupted file system, ext4_ext_replay_set_iblocks() can get stuck in an infinite loop. This could be reproduced by running generic/526 with a file system that has inline_data and fast_commit enabled. The system will repeatedly log to the console: EXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076 and the stack that it gets stuck in is: ext4_block_to_path+0xe3/0x130 ext4_ind_map_blocks+0x93/0x690 ext4_map_blocks+0x100/0x660 skip_hole+0x47/0x70 ext4_ext_replay_set_iblocks+0x223/0x440 ext4_fc_replay_inode+0x29e/0x3b0 ext4_fc_replay+0x278/0x550 do_one_pass+0x646/0xc10 jbd2_journ
GHSA
GHSA-95jj-pjw6-q9fr: In the Linux kernel, the following vulnerability has been resolved:
ext4: add error checking to ext4_ext_replay_set_iblocks()
If the call to ext4_ma
ghsa_unreviewed·2024-05-21
CVE-2021-47406 [MEDIUM] CWE-835 GHSA-95jj-pjw6-q9fr: In the Linux kernel, the following vulnerability has been resolved:
ext4: add error checking to ext4_ext_replay_set_iblocks()
If the call to ext4_ma
In the Linux kernel, the following vulnerability has been resolved:
ext4: add error checking to ext4_ext_replay_set_iblocks()
If the call to ext4_map_blocks() fails due to an corrupted file
system, ext4_ext_replay_set_iblocks() can get stuck in an infinite
loop. This could be reproduced by running generic/526 with a file
system that has inline_data and fast_commit enabled. The system will
repeatedly log to the console:
EXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076
and the stack that it gets stuck in is:
ext4_block_to_path+0xe3/0x130
ext4_ind_map_blocks+0x93/0x690
ext4_map_blocks+0x100/0x660
skip_hole+0x47/0x70
ext4_ext_replay_set_iblocks+0x223/0x440
ext4_fc_replay_inode+0x29e/0x3b0
ext4_fc_replay+0x278/0x550
do_one_pass+0x646/0xc10
jbd2_
OSV
CVE-2021-47406: In the Linux kernel, the following vulnerability has been resolved: ext4: add error checking to ext4_ext_replay_set_iblocks() If the call to ext4_map_
osv·2024-05-21·CVSS 5.5
CVE-2021-47406 [MEDIUM] CVE-2021-47406: In the Linux kernel, the following vulnerability has been resolved: ext4: add error checking to ext4_ext_replay_set_iblocks() If the call to ext4_map_
In the Linux kernel, the following vulnerability has been resolved: ext4: add error checking to ext4_ext_replay_set_iblocks() If the call to ext4_map_blocks() fails due to an corrupted file system, ext4_ext_replay_set_iblocks() can get stuck in an infinite loop. This could be reproduced by running generic/526 with a file system that has inline_data and fast_commit enabled. The system will repeatedly log to the console: EXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076 and the stack that it gets stuck in is: ext4_block_to_path+0xe3/0x130 ext4_ind_map_blocks+0x93/0x690 ext4_map_blocks+0x100/0x660 skip_hole+0x47/0x70 ext4_ext_replay_set_iblocks+0x223/0x440 ext4_fc_replay_inode+0x29e/0x3b0 ext4_fc_replay+0x278/0x550 do_one_pass+0x646/0xc10 jbd2_journ
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1fd95c05d8f742abfe906620780aee4dbe1a2db0https://git.kernel.org/stable/c/27e10c5d31ff1d222c7f797f1ee96d422859ba67https://git.kernel.org/stable/c/a63474dbf692dd09b50fed592bc41f6de5f102fchttps://git.kernel.org/stable/c/1fd95c05d8f742abfe906620780aee4dbe1a2db0https://git.kernel.org/stable/c/27e10c5d31ff1d222c7f797f1ee96d422859ba67https://git.kernel.org/stable/c/a63474dbf692dd09b50fed592bc41f6de5f102fc
2024-05-21
Published