CVE-2021-47113 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: btrfs: abort in rename_exchange if we fail to insert the second ref Error injection stress uncovered a problem where we'd leave a dangling inode ref if we failed during a rename_exchange. This happens because we insert the inode ref for one side of the rename, and then for the other side. If this second inode ref insert fails we'll leave the first one dangling and leave a corrupt file system behind. Fix this by aborting if we did the insert for the first inode ref.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932
https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5
https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b
https://lore.kernel.org/linux-cve-announce/2024031507-CVE-2021-47113-bf29@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2021-47113
https://www.cve.org/CVERecord?id=CVE-2021-47113

History

Mon, 04 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-03-15T20:14:21.300Z

Updated: 2024-11-04T11:59:39.913Z

Reserved: 2024-03-04T18:12:48.836Z

Link: CVE-2021-47113

Vulnrichment

Updated: 2024-08-04T05:24:39.855Z

NVD

Status : Awaiting Analysis

Published: 2024-03-15T21:15:06.673

Modified: 2024-03-17T22:38:29.433

Link: CVE-2021-47113

Redhat

Severity : Low

Publid Date: 2024-03-15T00:00:00Z

Links: CVE-2021-47113 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47113", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-04T18:12:48.836Z", "datePublished": "2024-03-15T20:14:21.300Z", "dateUpdated": "2024-11-04T11:59:39.913Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:59:39.913Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort in rename_exchange if we fail to insert the second ref\n\nError injection stress uncovered a problem where we'd leave a dangling\ninode ref if we failed during a rename_exchange. This happens because\nwe insert the inode ref for one side of the rename, and then for the\nother side. If this second inode ref insert fails we'll leave the first\none dangling and leave a corrupt file system behind. Fix this by\naborting if we did the insert for the first inode ref."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/inode.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "0df50d47d174", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "ff8de2cec65a", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "dc09ef356272", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/inode.c"], "versions": [{"version": "5.10.43", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.10", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932"}, {"url": "https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b"}, {"url": "https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5"}], "title": "btrfs: abort in rename_exchange if we fail to insert the second ref", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47113", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-18T15:16:26.695834Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:14:51.773Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.855Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.855Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47113", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-18T15:16:26.695834Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:18.327Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "btrfs: abort in rename_exchange if we fail to insert the second ref", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "0df50d47d174", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "ff8de2cec65a", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "dc09ef356272", "versionType": "git"}], "programFiles": ["fs/btrfs/inode.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "5.10.43", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.12.10", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/btrfs/inode.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932"}, {"url": "https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b"}, {"url": "https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort in rename_exchange if we fail to insert the second ref\n\nError injection stress uncovered a problem where we'd leave a dangling\ninode ref if we failed during a rename_exchange. This happens because\nwe insert the inode ref for one side of the rename, and then for the\nother side. If this second inode ref insert fails we'll leave the first\none dangling and leave a corrupt file system behind. Fix this by\naborting if we did the insert for the first inode ref."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:59:39.913Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47113", "state": "PUBLISHED", "dateUpdated": "2024-11-04T11:59:39.913Z", "dateReserved": "2024-03-04T18:12:48.836Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-15T20:14:21.300Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: btrfs: abort in rename_exchange if we fail to insert the second ref", "id": "2269867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269867"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbtrfs: abort in rename_exchange if we fail to insert the second ref\nError injection stress uncovered a problem where we'd leave a dangling\ninode ref if we failed during a rename_exchange. This happens because\nwe insert the inode ref for one side of the rename, and then for the\nother side. If this second inode ref insert fails we'll leave the first\none dangling and leave a corrupt file system behind. Fix this by\naborting if we did the insert for the first inode ref."], "name": "CVE-2021-47113", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47113\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47113\nhttps://lore.kernel.org/linux-cve-announce/2024031507-CVE-2021-47113-bf29@gregkh/T/#u"], "threat_severity": "Low", "upstream_fix": "kernel 5.10.43, kernel 5.12.10, kernel 5.13"}