CVE-2021-47342 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible UAF when remounting r/o a mmp-protected file system After commit 618f003199c6 ("ext4: fix memory leak in ext4_fill_super"), after the file system is remounted read-only, there is a race where the kmmpd thread can exit, causing sbi->s_mmp_tsk to point at freed memory, which the call to ext4_stop_mmpd() can trip over. Fix this by only allowing kmmpd() to exit when it is stopped via ext4_stop_mmpd(). Bug-Report-Link: <20210629143603.2166962-1-yebin10@huawei.com>

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/61bb4a1c417e5b95d9edb4f887f131de32e419cb
https://git.kernel.org/stable/c/7ed572cdf11081f8f9e07abd4bea56a3f2c4edbd
https://git.kernel.org/stable/c/b663890d854403e566169f7e90aed5cd6ff64f6b
https://lore.kernel.org/linux-cve-announce/2024052138-CVE-2021-47342-bfd5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2021-47342
https://www.cve.org/CVERecord?id=CVE-2021-47342

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-21T14:35:49.643Z

Updated: 2024-11-04T12:04:03.658Z

Reserved: 2024-05-21T14:28:16.979Z

Link: CVE-2021-47342

Vulnrichment

Updated: 2024-08-04T05:32:08.518Z

NVD

Status : Awaiting Analysis

Published: 2024-05-21T15:15:20.923

Modified: 2024-05-21T16:54:26.047

Link: CVE-2021-47342

Redhat

Severity : Low

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2021-47342 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47342", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T14:28:16.979Z", "datePublished": "2024-05-21T14:35:49.643Z", "dateUpdated": "2024-11-04T12:04:03.658Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:04:03.658Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix possible UAF when remounting r/o a mmp-protected file system\n\nAfter commit 618f003199c6 (\"ext4: fix memory leak in\next4_fill_super\"), after the file system is remounted read-only, there\nis a race where the kmmpd thread can exit, causing sbi->s_mmp_tsk to\npoint at freed memory, which the call to ext4_stop_mmpd() can trip\nover.\n\nFix this by only allowing kmmpd() to exit when it is stopped via\next4_stop_mmpd().\n\nBug-Report-Link: <20210629143603.2166962-1-yebin10@huawei.com>"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/mmp.c", "fs/ext4/super.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "b663890d8544", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "7ed572cdf110", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "61bb4a1c417e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/mmp.c", "fs/ext4/super.c"], "versions": [{"version": "5.10.77", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13.3", "lessThanOrEqual": "5.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/b663890d854403e566169f7e90aed5cd6ff64f6b"}, {"url": "https://git.kernel.org/stable/c/7ed572cdf11081f8f9e07abd4bea56a3f2c4edbd"}, {"url": "https://git.kernel.org/stable/c/61bb4a1c417e5b95d9edb4f887f131de32e419cb"}], "title": "ext4: fix possible UAF when remounting r/o a mmp-protected file system", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47342", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T18:31:24.504163Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:15:04.055Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.518Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b663890d854403e566169f7e90aed5cd6ff64f6b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7ed572cdf11081f8f9e07abd4bea56a3f2c4edbd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/61bb4a1c417e5b95d9edb4f887f131de32e419cb", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b663890d854403e566169f7e90aed5cd6ff64f6b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7ed572cdf11081f8f9e07abd4bea56a3f2c4edbd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/61bb4a1c417e5b95d9edb4f887f131de32e419cb", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.518Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47342", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T18:31:24.504163Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T18:31:29.638Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "ext4: fix possible UAF when remounting r/o a mmp-protected file system", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "b663890d8544", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "7ed572cdf110", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "61bb4a1c417e", "versionType": "git"}], "programFiles": ["fs/ext4/mmp.c", "fs/ext4/super.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "5.10.77", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.13.3", "versionType": "semver", "lessThanOrEqual": "5.13.*"}, {"status": "unaffected", "version": "5.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ext4/mmp.c", "fs/ext4/super.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b663890d854403e566169f7e90aed5cd6ff64f6b"}, {"url": "https://git.kernel.org/stable/c/7ed572cdf11081f8f9e07abd4bea56a3f2c4edbd"}, {"url": "https://git.kernel.org/stable/c/61bb4a1c417e5b95d9edb4f887f131de32e419cb"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix possible UAF when remounting r/o a mmp-protected file system\n\nAfter commit 618f003199c6 (\"ext4: fix memory leak in\next4_fill_super\"), after the file system is remounted read-only, there\nis a race where the kmmpd thread can exit, causing sbi->s_mmp_tsk to\npoint at freed memory, which the call to ext4_stop_mmpd() can trip\nover.\n\nFix this by only allowing kmmpd() to exit when it is stopped via\next4_stop_mmpd().\n\nBug-Report-Link: <20210629143603.2166962-1-yebin10@huawei.com>"}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:04:03.658Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47342", "state": "PUBLISHED", "dateUpdated": "2024-11-04T12:04:03.658Z", "dateReserved": "2024-05-21T14:28:16.979Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-21T14:35:49.643Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: ext4: fix possible UAF when remounting r/o a mmp-protected file system", "id": "2282417", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282417"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\next4: fix possible UAF when remounting r/o a mmp-protected file system\nAfter commit 618f003199c6 (\"ext4: fix memory leak in\next4_fill_super\"), after the file system is remounted read-only, there\nis a race where the kmmpd thread can exit, causing sbi->s_mmp_tsk to\npoint at freed memory, which the call to ext4_stop_mmpd() can trip\nover.\nFix this by only allowing kmmpd() to exit when it is stopped via\next4_stop_mmpd().\nBug-Report-Link: <20210629143603.2166962-1-yebin10@huawei.com>"], "name": "CVE-2021-47342", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47342\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47342\nhttps://lore.kernel.org/linux-cve-announce/2024052138-CVE-2021-47342-bfd5@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 5.10.77, kernel 5.13.3, kernel 5.14"}