CVE-2021-47656 (GCVE-0-2021-47656)
Vulnerability from cvelistv5
Published
2025-02-26 01:54
Modified
2025-05-04 07:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
When we mount a jffs2 image, assume that the first few blocks of
the image are normal and contain at least one xattr-related inode,
but the next block is abnormal. As a result, an error is returned
in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then
called in jffs2_build_filesystem() and then again in
jffs2_do_fill_super().
Finally we can observe the following report:
==================================================================
BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac
Read of size 8 at addr ffff8881243384e0 by task mount/719
Call Trace:
dump_stack+0x115/0x16b
jffs2_clear_xattr_subsystem+0x95/0x6ac
jffs2_do_fill_super+0x84f/0xc30
jffs2_fill_super+0x2ea/0x4c0
mtd_get_sb+0x254/0x400
mtd_get_sb_by_nr+0x4f/0xd0
get_tree_mtd+0x498/0x840
jffs2_get_tree+0x25/0x30
vfs_get_tree+0x8d/0x2e0
path_mount+0x50f/0x1e50
do_mount+0x107/0x130
__se_sys_mount+0x1c5/0x2f0
__x64_sys_mount+0xc7/0x160
do_syscall_64+0x45/0x70
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Allocated by task 719:
kasan_save_stack+0x23/0x60
__kasan_kmalloc.constprop.0+0x10b/0x120
kasan_slab_alloc+0x12/0x20
kmem_cache_alloc+0x1c0/0x870
jffs2_alloc_xattr_ref+0x2f/0xa0
jffs2_scan_medium.cold+0x3713/0x4794
jffs2_do_mount_fs.cold+0xa7/0x2253
jffs2_do_fill_super+0x383/0xc30
jffs2_fill_super+0x2ea/0x4c0
[...]
Freed by task 719:
kmem_cache_free+0xcc/0x7b0
jffs2_free_xattr_ref+0x78/0x98
jffs2_clear_xattr_subsystem+0xa1/0x6ac
jffs2_do_mount_fs.cold+0x5e6/0x2253
jffs2_do_fill_super+0x383/0xc30
jffs2_fill_super+0x2ea/0x4c0
[...]
The buggy address belongs to the object at ffff8881243384b8
which belongs to the cache jffs2_xattr_ref of size 48
The buggy address is located 40 bytes inside of
48-byte region [ffff8881243384b8, ffff8881243384e8)
[...]
==================================================================
The triggering of the BUG is shown in the following stack:
-----------------------------------------------------------
jffs2_fill_super
jffs2_do_fill_super
jffs2_do_mount_fs
jffs2_build_filesystem
jffs2_scan_medium
jffs2_scan_eraseblock <--- ERROR
jffs2_clear_xattr_subsystem <--- free
jffs2_clear_xattr_subsystem <--- free again
-----------------------------------------------------------
An error is returned in jffs2_do_mount_fs(). If the error is returned
by jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to
be executed. If the error is returned by jffs2_build_filesystem(), the
jffs2_clear_xattr_subsystem() also does not need to be executed again.
So move jffs2_clear_xattr_subsystem() from 'out_inohash' to 'out_root'
to fix this UAF problem.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: aa98d7cf59b5b0764d3502662053489585faf2fe Version: aa98d7cf59b5b0764d3502662053489585faf2fe Version: aa98d7cf59b5b0764d3502662053489585faf2fe Version: aa98d7cf59b5b0764d3502662053489585faf2fe Version: aa98d7cf59b5b0764d3502662053489585faf2fe Version: aa98d7cf59b5b0764d3502662053489585faf2fe Version: aa98d7cf59b5b0764d3502662053489585faf2fe Version: aa98d7cf59b5b0764d3502662053489585faf2fe Version: aa98d7cf59b5b0764d3502662053489585faf2fe |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-47656",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-27T17:59:35.381270Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T18:02:30.510Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/jffs2/fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9150cb625b46f68d524f4cfd491f1aafc23e10a9",
"status": "affected",
"version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
"versionType": "git"
},
{
"lessThan": "3bd2454162ec6bbb5503233c804fce6e4b6dcec5",
"status": "affected",
"version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
"versionType": "git"
},
{
"lessThan": "c3b07c875fa8f906f932976460fd14798596f101",
"status": "affected",
"version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
"versionType": "git"
},
{
"lessThan": "30bf7244acf32f19cb722c39f7bc1c2a9f300422",
"status": "affected",
"version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
"versionType": "git"
},
{
"lessThan": "7bb7428dd73991bf4b3a7a61b493ca50046c2b13",
"status": "affected",
"version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
"versionType": "git"
},
{
"lessThan": "7a75740206af5f17e9f3efa384211cba70213da1",
"status": "affected",
"version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
"versionType": "git"
},
{
"lessThan": "22327bd7988f21de3a53c1373f3b81542bfe1f44",
"status": "affected",
"version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
"versionType": "git"
},
{
"lessThan": "8c0f024f29e055840a5a89fe23b96ae3f921afed",
"status": "affected",
"version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
"versionType": "git"
},
{
"lessThan": "4c7c44ee1650677fbe89d86edbad9497b7679b5c",
"status": "affected",
"version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/jffs2/fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.311",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.276",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.238",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.16.*",
"status": "unaffected",
"version": "5.16.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.17.*",
"status": "unaffected",
"version": "5.17.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.311",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.276",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.238",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.189",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.110",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.33",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.16.19",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.2",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: fix use-after-free in jffs2_clear_xattr_subsystem\n\nWhen we mount a jffs2 image, assume that the first few blocks of\nthe image are normal and contain at least one xattr-related inode,\nbut the next block is abnormal. As a result, an error is returned\nin jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then\ncalled in jffs2_build_filesystem() and then again in\njffs2_do_fill_super().\n\nFinally we can observe the following report:\n ==================================================================\n BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac\n Read of size 8 at addr ffff8881243384e0 by task mount/719\n\n Call Trace:\n dump_stack+0x115/0x16b\n jffs2_clear_xattr_subsystem+0x95/0x6ac\n jffs2_do_fill_super+0x84f/0xc30\n jffs2_fill_super+0x2ea/0x4c0\n mtd_get_sb+0x254/0x400\n mtd_get_sb_by_nr+0x4f/0xd0\n get_tree_mtd+0x498/0x840\n jffs2_get_tree+0x25/0x30\n vfs_get_tree+0x8d/0x2e0\n path_mount+0x50f/0x1e50\n do_mount+0x107/0x130\n __se_sys_mount+0x1c5/0x2f0\n __x64_sys_mount+0xc7/0x160\n do_syscall_64+0x45/0x70\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\n Allocated by task 719:\n kasan_save_stack+0x23/0x60\n __kasan_kmalloc.constprop.0+0x10b/0x120\n kasan_slab_alloc+0x12/0x20\n kmem_cache_alloc+0x1c0/0x870\n jffs2_alloc_xattr_ref+0x2f/0xa0\n jffs2_scan_medium.cold+0x3713/0x4794\n jffs2_do_mount_fs.cold+0xa7/0x2253\n jffs2_do_fill_super+0x383/0xc30\n jffs2_fill_super+0x2ea/0x4c0\n [...]\n\n Freed by task 719:\n kmem_cache_free+0xcc/0x7b0\n jffs2_free_xattr_ref+0x78/0x98\n jffs2_clear_xattr_subsystem+0xa1/0x6ac\n jffs2_do_mount_fs.cold+0x5e6/0x2253\n jffs2_do_fill_super+0x383/0xc30\n jffs2_fill_super+0x2ea/0x4c0\n [...]\n\n The buggy address belongs to the object at ffff8881243384b8\n which belongs to the cache jffs2_xattr_ref of size 48\n The buggy address is located 40 bytes inside of\n 48-byte region [ffff8881243384b8, ffff8881243384e8)\n [...]\n ==================================================================\n\nThe triggering of the BUG is shown in the following stack:\n-----------------------------------------------------------\njffs2_fill_super\n jffs2_do_fill_super\n jffs2_do_mount_fs\n jffs2_build_filesystem\n jffs2_scan_medium\n jffs2_scan_eraseblock \u003c--- ERROR\n jffs2_clear_xattr_subsystem \u003c--- free\n jffs2_clear_xattr_subsystem \u003c--- free again\n-----------------------------------------------------------\n\nAn error is returned in jffs2_do_mount_fs(). If the error is returned\nby jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to\nbe executed. If the error is returned by jffs2_build_filesystem(), the\njffs2_clear_xattr_subsystem() also does not need to be executed again.\nSo move jffs2_clear_xattr_subsystem() from \u0027out_inohash\u0027 to \u0027out_root\u0027\nto fix this UAF problem."
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T07:15:43.185Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9"
},
{
"url": "https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5"
},
{
"url": "https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101"
},
{
"url": "https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422"
},
{
"url": "https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13"
},
{
"url": "https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1"
},
{
"url": "https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44"
},
{
"url": "https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed"
},
{
"url": "https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5c"
}
],
"title": "jffs2: fix use-after-free in jffs2_clear_xattr_subsystem",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47656",
"datePublished": "2025-02-26T01:54:20.069Z",
"dateReserved": "2025-02-26T01:48:21.521Z",
"dateUpdated": "2025-05-04T07:15:43.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2021-47656\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T06:37:07.360\",\"lastModified\":\"2025-03-24T17:45:55.750\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\njffs2: fix use-after-free in jffs2_clear_xattr_subsystem\\n\\nWhen we mount a jffs2 image, assume that the first few blocks of\\nthe image are normal and contain at least one xattr-related inode,\\nbut the next block is abnormal. As a result, an error is returned\\nin jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then\\ncalled in jffs2_build_filesystem() and then again in\\njffs2_do_fill_super().\\n\\nFinally we can observe the following report:\\n ==================================================================\\n BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac\\n Read of size 8 at addr ffff8881243384e0 by task mount/719\\n\\n Call Trace:\\n dump_stack+0x115/0x16b\\n jffs2_clear_xattr_subsystem+0x95/0x6ac\\n jffs2_do_fill_super+0x84f/0xc30\\n jffs2_fill_super+0x2ea/0x4c0\\n mtd_get_sb+0x254/0x400\\n mtd_get_sb_by_nr+0x4f/0xd0\\n get_tree_mtd+0x498/0x840\\n jffs2_get_tree+0x25/0x30\\n vfs_get_tree+0x8d/0x2e0\\n path_mount+0x50f/0x1e50\\n do_mount+0x107/0x130\\n __se_sys_mount+0x1c5/0x2f0\\n __x64_sys_mount+0xc7/0x160\\n do_syscall_64+0x45/0x70\\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\n Allocated by task 719:\\n kasan_save_stack+0x23/0x60\\n __kasan_kmalloc.constprop.0+0x10b/0x120\\n kasan_slab_alloc+0x12/0x20\\n kmem_cache_alloc+0x1c0/0x870\\n jffs2_alloc_xattr_ref+0x2f/0xa0\\n jffs2_scan_medium.cold+0x3713/0x4794\\n jffs2_do_mount_fs.cold+0xa7/0x2253\\n jffs2_do_fill_super+0x383/0xc30\\n jffs2_fill_super+0x2ea/0x4c0\\n [...]\\n\\n Freed by task 719:\\n kmem_cache_free+0xcc/0x7b0\\n jffs2_free_xattr_ref+0x78/0x98\\n jffs2_clear_xattr_subsystem+0xa1/0x6ac\\n jffs2_do_mount_fs.cold+0x5e6/0x2253\\n jffs2_do_fill_super+0x383/0xc30\\n jffs2_fill_super+0x2ea/0x4c0\\n [...]\\n\\n The buggy address belongs to the object at ffff8881243384b8\\n which belongs to the cache jffs2_xattr_ref of size 48\\n The buggy address is located 40 bytes inside of\\n 48-byte region [ffff8881243384b8, ffff8881243384e8)\\n [...]\\n ==================================================================\\n\\nThe triggering of the BUG is shown in the following stack:\\n-----------------------------------------------------------\\njffs2_fill_super\\n jffs2_do_fill_super\\n jffs2_do_mount_fs\\n jffs2_build_filesystem\\n jffs2_scan_medium\\n jffs2_scan_eraseblock \u003c--- ERROR\\n jffs2_clear_xattr_subsystem \u003c--- free\\n jffs2_clear_xattr_subsystem \u003c--- free again\\n-----------------------------------------------------------\\n\\nAn error is returned in jffs2_do_mount_fs(). If the error is returned\\nby jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to\\nbe executed. If the error is returned by jffs2_build_filesystem(), the\\njffs2_clear_xattr_subsystem() also does not need to be executed again.\\nSo move jffs2_clear_xattr_subsystem() from \u0027out_inohash\u0027 to \u0027out_root\u0027\\nto fix this UAF problem.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: jffs2: se corrige el use-after-free en jffs2_clear_xattr_subsystem Cuando montamos una imagen jffs2, asumimos que los primeros bloques de la imagen son normales y contienen al menos un inodo relacionado con xattr, pero el siguiente bloque es anormal. Como resultado, se devuelve un error en jffs2_scan_eraseblock(). Luego se llama a jffs2_clear_xattr_subsystem() en jffs2_build_filesystem() y luego nuevamente en jffs2_do_fill_super(). Finalmente podemos observar el siguiente reporte: ======================================================================= ERROR: KASAN: use-after-free en jffs2_clear_xattr_subsystem+0x95/0x6ac Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff8881243384e0 por la tarea mount/719 Rastreo de llamadas: dump_stack+0x115/0x16b jffs2_clear_xattr_subsystem+0x95/0x6ac jffs2_do_fill_super+0x84f/0xc30 jffs2_fill_super+0x2ea/0x4c0 mtd_get_sb+0x254/0x400 mtd_get_sb_by_nr+0x4f/0xd0 get_tree_mtd+0x498/0x840 jffs2_get_tree+0x25/0x30 vfs_get_tree+0x8d/0x2e0 path_mount+0x50f/0x1e50 do_mount+0x107/0x130 __se_sys_mount+0x1c5/0x2f0 __x64_sys_mount+0xc7/0x160 do_syscall_64+0x45/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Asignado por la tarea 719: kasan_save_stack+0x23/0x60 __kasan_kmalloc.constprop.0+0x10b/0x120 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0x1c0/0x870 jffs2_alloc_xattr_ref+0x2f/0xa0 jffs2_scan_medium.cold+0x3713/0x4794 jffs2_do_mount_fs.cold+0xa7/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] Liberado por la tarea 719: kmem_cache_free+0xcc/0x7b0 jffs2_free_xattr_ref+0x78/0x98 jffs2_clear_xattr_subsystem+0xa1/0x6ac jffs2_do_mount_fs.cold+0x5e6/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] La direcci\u00f3n con errores pertenece al objeto en ffff8881243384b8 que pertenece al cach\u00e9 jffs2_xattr_ref de tama\u00f1o 48 La direcci\u00f3n con errores se encuentra 40 bytes dentro de la regi\u00f3n de 48 bytes [ffff8881243384b8, ffff8881243384e8) [...] ========================================================================== La activaci\u00f3n del ERROR se muestra en la siguiente pila: ----------------------------------------------------------- jffs2_fill_super jffs2_do_fill_super jffs2_do_mount_fs jffs2_build_filesystem jffs2_scan_medium jffs2_scan_eraseblock \u0026lt;--- ERROR jffs2_clear_xattr_subsystem \u0026lt;--- free jffs2_clear_xattr_subsystem \u0026lt;--- free again ----------------------------------------------------------- Se devuelve un error en jffs2_do_mount_fs(). Si jffs2_sum_init() devuelve el error, no es necesario ejecutar jffs2_clear_xattr_subsystem(). Si jffs2_build_filesystem() devuelve el error, tampoco es necesario volver a ejecutar jffs2_clear_xattr_subsystem(). Por lo tanto, mueva jffs2_clear_xattr_subsystem() de \u0027out_inohash\u0027 a \u0027out_root\u0027 para solucionar este problema de UAF.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.18\",\"versionEndExcluding\":\"4.9.311\",\"matchCriteriaId\":\"EB5E8137-261D-4D1B-A71B-A70EE8FD2C08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.276\",\"matchCriteriaId\":\"6D9B028C-6313-47F9-94B7-5F8122345E49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.238\",\"matchCriteriaId\":\"FA28527A-11D3-41D2-9C4C-ECAC0D6A4A2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.189\",\"matchCriteriaId\":\"8CB6E8F5-C2B1-46F3-A807-0F6104AC340F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.110\",\"matchCriteriaId\":\"91D3BFD0-D3F3-4018-957C-96CCBF357D79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.33\",\"matchCriteriaId\":\"27C42AE8-B387-43E2-938A-E1C8B40BE6D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.2\",\"matchCriteriaId\":\"210C679C-CF84-44A3-8939-E629C87E54BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-02-26T01:54:20.069Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\njffs2: fix use-after-free in jffs2_clear_xattr_subsystem\\n\\nWhen we mount a jffs2 image, assume that the first few blocks of\\nthe image are normal and contain at least one xattr-related inode,\\nbut the next block is abnormal. As a result, an error is returned\\nin jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then\\ncalled in jffs2_build_filesystem() and then again in\\njffs2_do_fill_super().\\n\\nFinally we can observe the following report:\\n ==================================================================\\n BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac\\n Read of size 8 at addr ffff8881243384e0 by task mount/719\\n\\n Call Trace:\\n dump_stack+0x115/0x16b\\n jffs2_clear_xattr_subsystem+0x95/0x6ac\\n jffs2_do_fill_super+0x84f/0xc30\\n jffs2_fill_super+0x2ea/0x4c0\\n mtd_get_sb+0x254/0x400\\n mtd_get_sb_by_nr+0x4f/0xd0\\n get_tree_mtd+0x498/0x840\\n jffs2_get_tree+0x25/0x30\\n vfs_get_tree+0x8d/0x2e0\\n path_mount+0x50f/0x1e50\\n do_mount+0x107/0x130\\n __se_sys_mount+0x1c5/0x2f0\\n __x64_sys_mount+0xc7/0x160\\n do_syscall_64+0x45/0x70\\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\n Allocated by task 719:\\n kasan_save_stack+0x23/0x60\\n __kasan_kmalloc.constprop.0+0x10b/0x120\\n kasan_slab_alloc+0x12/0x20\\n kmem_cache_alloc+0x1c0/0x870\\n jffs2_alloc_xattr_ref+0x2f/0xa0\\n jffs2_scan_medium.cold+0x3713/0x4794\\n jffs2_do_mount_fs.cold+0xa7/0x2253\\n jffs2_do_fill_super+0x383/0xc30\\n jffs2_fill_super+0x2ea/0x4c0\\n [...]\\n\\n Freed by task 719:\\n kmem_cache_free+0xcc/0x7b0\\n jffs2_free_xattr_ref+0x78/0x98\\n jffs2_clear_xattr_subsystem+0xa1/0x6ac\\n jffs2_do_mount_fs.cold+0x5e6/0x2253\\n jffs2_do_fill_super+0x383/0xc30\\n jffs2_fill_super+0x2ea/0x4c0\\n [...]\\n\\n The buggy address belongs to the object at ffff8881243384b8\\n which belongs to the cache jffs2_xattr_ref of size 48\\n The buggy address is located 40 bytes inside of\\n 48-byte region [ffff8881243384b8, ffff8881243384e8)\\n [...]\\n ==================================================================\\n\\nThe triggering of the BUG is shown in the following stack:\\n-----------------------------------------------------------\\njffs2_fill_super\\n jffs2_do_fill_super\\n jffs2_do_mount_fs\\n jffs2_build_filesystem\\n jffs2_scan_medium\\n jffs2_scan_eraseblock \u003c--- ERROR\\n jffs2_clear_xattr_subsystem \u003c--- free\\n jffs2_clear_xattr_subsystem \u003c--- free again\\n-----------------------------------------------------------\\n\\nAn error is returned in jffs2_do_mount_fs(). If the error is returned\\nby jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to\\nbe executed. If the error is returned by jffs2_build_filesystem(), the\\njffs2_clear_xattr_subsystem() also does not need to be executed again.\\nSo move jffs2_clear_xattr_subsystem() from \u0027out_inohash\u0027 to \u0027out_root\u0027\\nto fix this UAF problem.\"}], \"affected\": [{\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"unaffected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"fs/jffs2/fs.c\"], \"versions\": [{\"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"9150cb625b46f68d524f4cfd491f1aafc23e10a9\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"3bd2454162ec6bbb5503233c804fce6e4b6dcec5\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"c3b07c875fa8f906f932976460fd14798596f101\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"30bf7244acf32f19cb722c39f7bc1c2a9f300422\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"7bb7428dd73991bf4b3a7a61b493ca50046c2b13\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"7a75740206af5f17e9f3efa384211cba70213da1\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"22327bd7988f21de3a53c1373f3b81542bfe1f44\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"8c0f024f29e055840a5a89fe23b96ae3f921afed\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"4c7c44ee1650677fbe89d86edbad9497b7679b5c\", \"status\": \"affected\", \"versionType\": \"git\"}]}, {\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"affected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"fs/jffs2/fs.c\"], \"versions\": [{\"version\": \"2.6.18\", \"status\": \"affected\"}, {\"version\": \"0\", \"lessThan\": \"2.6.18\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"4.9.311\", \"lessThanOrEqual\": \"4.9.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"4.14.276\", \"lessThanOrEqual\": \"4.14.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"4.19.238\", \"lessThanOrEqual\": \"4.19.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.4.189\", \"lessThanOrEqual\": \"5.4.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.10.110\", \"lessThanOrEqual\": \"5.10.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.15.33\", \"lessThanOrEqual\": \"5.15.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.16.19\", \"lessThanOrEqual\": \"5.16.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.17.2\", \"lessThanOrEqual\": \"5.17.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.18\", \"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"versionType\": \"original_commit_for_fix\"}]}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9\"}, {\"url\": \"https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5\"}, {\"url\": \"https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101\"}, {\"url\": \"https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422\"}, {\"url\": \"https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13\"}, {\"url\": \"https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1\"}, {\"url\": \"https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44\"}, {\"url\": \"https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed\"}, {\"url\": \"https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5c\"}], \"title\": \"jffs2: fix use-after-free in jffs2_clear_xattr_subsystem\", \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47656\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T17:59:35.381270Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T17:59:36.648Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2021-47656\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2025-02-26T01:48:21.521Z\", \"datePublished\": \"2025-02-26T01:54:20.069Z\", \"dateUpdated\": \"2025-02-27T18:02:30.510Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}