CVE-2021-47433 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix abort logic in btrfs_replace_file_extents Error injection testing uncovered a case where we'd end up with a corrupt file system with a missing extent in the middle of a file. This occurs because the if statement to decide if we should abort is wrong. The only way we would abort in this case is if we got a ret != -EOPNOTSUPP and we called from the file clone code. However the prealloc code uses this path too. Instead we need to abort if there is an error, and the only error we _don't_ abort on is -EOPNOTSUPP and only if we came from the clone file code.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c
https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378
https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f
https://nvd.nist.gov/vuln/detail/CVE-2021-47433
https://www.cve.org/CVERecord?id=CVE-2021-47433

History

Mon, 04 Nov 2024 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-22T06:19:30.244Z

Updated: 2024-11-04T12:05:49.359Z

Reserved: 2024-05-21T14:58:30.830Z

Link: CVE-2021-47433

Vulnrichment

Updated: 2024-08-04T05:39:59.455Z

NVD

Status : Awaiting Analysis

Published: 2024-05-22T07:15:08.347

Modified: 2024-05-22T12:46:53.887

Link: CVE-2021-47433

Redhat

Severity : Moderate

Publid Date: 2024-05-22T00:00:00Z

Links: CVE-2021-47433 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47433", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T14:58:30.830Z", "datePublished": "2024-05-22T06:19:30.244Z", "dateUpdated": "2024-11-04T12:05:49.359Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:05:49.359Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix abort logic in btrfs_replace_file_extents\n\nError injection testing uncovered a case where we'd end up with a\ncorrupt file system with a missing extent in the middle of a file. This\noccurs because the if statement to decide if we should abort is wrong.\n\nThe only way we would abort in this case is if we got a ret !=\n-EOPNOTSUPP and we called from the file clone code. However the\nprealloc code uses this path too. Instead we need to abort if there is\nan error, and the only error we _don't_ abort on is -EOPNOTSUPP and only\nif we came from the clone file code."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/file.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "0e32a2b85c7d", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "0e309e1152fc", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "4afb912f439c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/file.c"], "versions": [{"version": "5.10.75", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.14.14", "lessThanOrEqual": "5.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378"}, {"url": "https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c"}, {"url": "https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f"}], "title": "btrfs: fix abort logic in btrfs_replace_file_extents", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-10T18:56:43.265826Z", "id": "CVE-2021-47433", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-10T18:57:31.785Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.455Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.455Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47433", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-10T18:56:43.265826Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-10T18:57:27.813Z"}}], "cna": {"title": "btrfs: fix abort logic in btrfs_replace_file_extents", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "0e32a2b85c7d", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "0e309e1152fc", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "4afb912f439c", "versionType": "git"}], "programFiles": ["fs/btrfs/file.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "5.10.75", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.14.14", "versionType": "semver", "lessThanOrEqual": "5.14.*"}, {"status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/btrfs/file.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378"}, {"url": "https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c"}, {"url": "https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix abort logic in btrfs_replace_file_extents\n\nError injection testing uncovered a case where we'd end up with a\ncorrupt file system with a missing extent in the middle of a file. This\noccurs because the if statement to decide if we should abort is wrong.\n\nThe only way we would abort in this case is if we got a ret !=\n-EOPNOTSUPP and we called from the file clone code. However the\nprealloc code uses this path too. Instead we need to abort if there is\nan error, and the only error we _don't_ abort on is -EOPNOTSUPP and only\nif we came from the clone file code."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:05:49.359Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47433", "state": "PUBLISHED", "dateUpdated": "2024-11-04T12:05:49.359Z", "dateReserved": "2024-05-21T14:58:30.830Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-22T06:19:30.244Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: btrfs: fix abort logic in btrfs_replace_file_extents", "id": "2282881", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282881"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-754", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbtrfs: fix abort logic in btrfs_replace_file_extents\nError injection testing uncovered a case where we'd end up with a\ncorrupt file system with a missing extent in the middle of a file. This\noccurs because the if statement to decide if we should abort is wrong.\nThe only way we would abort in this case is if we got a ret !=\n-EOPNOTSUPP and we called from the file clone code. However the\nprealloc code uses this path too. Instead we need to abort if there is\nan error, and the only error we _don't_ abort on is -EOPNOTSUPP and only\nif we came from the clone file code.", "A vulnerability was found in the btrfs file system's `btrfs_replace_file_extents` function within the Linux kernel. This issue potentially leads to an abort logic failure, impacting the integrity and stability of file operations."], "name": "CVE-2021-47433", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47433\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47433"], "threat_severity": "Moderate", "upstream_fix": "kernel 5.10.75, kernel 5.14.14, kernel 5.15"}