CVE-2021-47656
published 2025-02-26CVE-2021-47656: In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem When we mount a jffs2 image…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
16.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
When we mount a jffs2 image, assume that the first few blocks of
the image are normal and contain at least one xattr-related inode,
but the next block is abnormal. As a result, an error is returned
in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then
called in jffs2_build_filesystem() and then again in
jffs2_do_fill_super().
Finally we can observe the following report:
BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac
Read of size 8 at addr ffff8881243384e0 by task mount/719
Call Trace:
dump_stack+0x115/0x16b
jffs2_clear_xattr_subsystem+0x95/0x6ac
jffs2_do_fill_super+0x84f/0xc30
jffs2_fill_super+0x2ea/0x4c0
mtd_get_sb+0x254/0x400
mtd_get_sb_by_nr+0x4f/0xd0
get_tree_mtd+0x498/0x840
jffs2_get_tree+0x25/0x30
vfs_get_tree+0x8d/0x2e0
path_mount+0x50f/0x1e50
do_mount+0x107/0x130
__se_sys_mount+0x1c5/0x2f0
__x64_sys_mount+0xc7/0x160
do_syscall_64+0x45/0x70
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Allocated by task 719:
kasan_save_stack+0x23/0x60
__kasan_kmalloc.constprop.0+0x10b/0x120
kasan_slab_alloc+0x12/0x20
kmem_cache_alloc+0x1c0/0x870
jffs2_alloc_xattr_ref+0x2f/0xa0
jffs2_scan_medium.cold+0x3713/0x4794
jffs2_do_mount_fs.cold+0xa7/0x2253
jffs2_do_fill_super+0x383/0xc30
jffs2_fill_super+0x2ea/0x4c0
[...]
Freed by task 719:
kmem_cache_free+0xcc/0x7b0
jffs2_free_xattr_ref+0x78/0x98
jffs2_clear_xattr_subsystem+0xa1/0x6ac
jffs2_do_mount_fs.cold+0x5e6/0x2253
jffs2_do_fill_super+0x383/0xc30
jffs2_fill_super+0x2ea/0x4c0
[...]
The buggy address belongs to the object at ffff8881243384b8
which belongs to the cache jffs2_xattr_ref of size 48
The buggy address is located 40 bytes inside of
48-byte region [ffff8881243384b8, ffff8881243384e8)
[...]
The triggering of the BUG is shown in the following stack:
jffs2_fill_super
jffs2_do_fill_super
jffs2_do_mount_fs
jffs2_build_filesystem
jffs2_scan_medium
jffs2_scan_eraseblock
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.3-1 (bookworm) | linux 5.17.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= aa98d7cf59b5b0764d3502662053489585faf2fe < 9150cb625b46f68d524f4cfd491f1aafc23e10a9 | 9150cb625b46f68d524f4cfd491f1aafc23e10a9 |
| linux | linux | >= aa98d7cf59b5b0764d3502662053489585faf2fe < 3bd2454162ec6bbb5503233c804fce6e4b6dcec5 | 3bd2454162ec6bbb5503233c804fce6e4b6dcec5 |
| linux | linux | >= aa98d7cf59b5b0764d3502662053489585faf2fe < c3b07c875fa8f906f932976460fd14798596f101 | c3b07c875fa8f906f932976460fd14798596f101 |
| linux | linux | >= aa98d7cf59b5b0764d3502662053489585faf2fe < 30bf7244acf32f19cb722c39f7bc1c2a9f300422 | 30bf7244acf32f19cb722c39f7bc1c2a9f300422 |
| linux | linux | >= aa98d7cf59b5b0764d3502662053489585faf2fe < 7bb7428dd73991bf4b3a7a61b493ca50046c2b13 | 7bb7428dd73991bf4b3a7a61b493ca50046c2b13 |
| linux | linux | >= aa98d7cf59b5b0764d3502662053489585faf2fe < 7a75740206af5f17e9f3efa384211cba70213da1 | 7a75740206af5f17e9f3efa384211cba70213da1 |
| linux | linux | >= aa98d7cf59b5b0764d3502662053489585faf2fe < 22327bd7988f21de3a53c1373f3b81542bfe1f44 | 22327bd7988f21de3a53c1373f3b81542bfe1f44 |
| linux | linux | >= aa98d7cf59b5b0764d3502662053489585faf2fe < 8c0f024f29e055840a5a89fe23b96ae3f921afed | 8c0f024f29e055840a5a89fe23b96ae3f921afed |
| linux | linux | >= aa98d7cf59b5b0764d3502662053489585faf2fe < 4c7c44ee1650677fbe89d86edbad9497b7679b5c | 4c7c44ee1650677fbe89d86edbad9497b7679b5c |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 2.6.18 < 4.9.311 | 4.9.311 |
| linux | linux_kernel | >= 4.10 < 4.14.276 | 4.14.276 |
| linux | linux_kernel | >= 4.15 < 4.19.238 | 4.19.238 |
| linux | linux_kernel | >= 4.20 < 5.4.189 | 5.4.189 |
| linux | linux_kernel | >= 5.11 < 5.15.33 | 5.15.33 |
| linux | linux_kernel | >= 5.16 < 5.16.19 | 5.16.19 |
| linux | linux_kernel | >= 5.17 < 5.17.2 | 5.17.2 |
| linux | linux_kernel | >= 5.5 < 5.10.110 | 5.10.110 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4mx7-h455-mwxv: In the Linux kernel, the following vulnerability has been resolved:
jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
When we mount a jffs2 i
ghsa_unreviewed·2025-02-27
CVE-2021-47656 [HIGH] CWE-416 GHSA-4mx7-h455-mwxv: In the Linux kernel, the following vulnerability has been resolved:
jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
When we mount a jffs2 i
In the Linux kernel, the following vulnerability has been resolved:
jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
When we mount a jffs2 image, assume that the first few blocks of
the image are normal and contain at least one xattr-related inode,
but the next block is abnormal. As a result, an error is returned
in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then
called in jffs2_build_filesystem() and then again in
jffs2_do_fill_super().
Finally we can observe the following report:
BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac
Read of size 8 at addr ffff8881243384e0 by task mount/719
Call Trace:
dump_stack+0x115/0x16b
jffs2_clear_xattr_subsystem+0x95/0x6ac
jffs2_do_fill_super+0x84f/0xc30
jffs2_fill_super+0x2ea/0x4c0
mtd_get_sb+0x254/0x400
m
OSV
CVE-2021-47656: In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem When we mount a jffs2 ima
osv·2025-02-26·CVSS 7.8
CVE-2021-47656 [HIGH] CVE-2021-47656: In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem When we mount a jffs2 ima
In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem When we mount a jffs2 image, assume that the first few blocks of the image are normal and contain at least one xattr-related inode, but the next block is abnormal. As a result, an error is returned in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then called in jffs2_build_filesystem() and then again in jffs2_do_fill_super(). Finally we can observe the following report: ================================================================== BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac Read of size 8 at addr ffff8881243384e0 by task mount/719 Call Trace: dump_stack+0x115/0x16b jffs2_clear_xattr_subsystem+0x95/0x6ac jffs2_do_fill_super+0x
Red Hat
kernel: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
vendor_redhat·2025-02-26·CVSS 7.8
CVE-2021-47656 [HIGH] CWE-416 kernel: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
kernel: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
In the Linux kernel, the following vulnerability has been resolved:
jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
When we mount a jffs2 image, assume that the first few blocks of
the image are normal and contain at least one xattr-related inode,
but the next block is abnormal. As a result, an error is returned
in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then
called in jffs2_build_filesystem() and then again in
jffs2_do_fill_super().
Finally we can observe the following report:
BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac
Read of size 8 at addr ffff8881243384e0 by task mount/719
Call Trace:
dump_stack+0x115/0x16b
jffs2_clear_xattr_subsystem+0x95/0x6ac
jffs2_do_fill_super+0x8
Debian
CVE-2021-47656: linux - In the Linux kernel, the following vulnerability has been resolved: jffs2: fix ...
vendor_debian·2021·CVSS 7.8
CVE-2021-47656 [HIGH] CVE-2021-47656: linux - In the Linux kernel, the following vulnerability has been resolved: jffs2: fix ...
In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem When we mount a jffs2 image, assume that the first few blocks of the image are normal and contain at least one xattr-related inode, but the next block is abnormal. As a result, an error is returned in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then called in jffs2_build_filesystem() and then again in jffs2_do_fill_super(). Finally we can observe the following report: ================================================================== BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac Read of size 8 at addr ffff8881243384e0 by task mount/719 Call Trace: dump_stack+0x115/0x16b jffs2_clear_xattr_subsystem+0x95/0x6ac jffs2_do_fill_super+0x
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5chttps://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afedhttps://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101
2025-02-26
Published