{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47508", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-22T06:20:56.206Z", "datePublished": "2024-05-24T15:01:54.048Z", "dateUpdated": "2024-09-11T17:33:22.299Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:09:11.002Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free exchange changeset on failures\n\nFstests runs on my VMs have show several kmemleak reports like the following.\n\n unreferenced object 0xffff88811ae59080 (size 64):\n comm \"xfs_io\", pid 12124, jiffies 4294987392 (age 6.368s)\n hex dump (first 32 bytes):\n 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................\n 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................\n backtrace:\n [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs]\n [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs]\n [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs]\n [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs]\n [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs]\n [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs]\n [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs]\n [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs]\n [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0\n [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700\n [<000000002567ba53>] iomap_dio_rw+0x5/0x20\n [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs]\n [<000000005eb3d845>] new_sync_write+0x106/0x180\n [<000000003fb505bf>] vfs_write+0x24d/0x2f0\n [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0\n [<000000003eba3fdf>] do_syscall_64+0x43/0x90\n\nIn case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata()\nfail the allocated extent_changeset will not be freed.\n\nSo in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space()\nfree the allocated extent_changeset to get rid of the allocated memory.\n\nThe issue currently only happens in the direct IO write path, but only\nafter 65b3c08606e5 (\"btrfs: fix ENOSPC failure when attempting direct IO\nwrite into NOCOW range\"), and also at defrag_one_locked_target(). Every\nother place is always calling extent_changeset_free() even if its call\nto btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has\nfailed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/delalloc-space.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "ca06c5cb1b6d", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "da5e817d9d75", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/delalloc-space.c"], "versions": [{"version": "5.15.8", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/ca06c5cb1b6dbfe67655b33c02fc394d65824519"}, {"url": "https://git.kernel.org/stable/c/da5e817d9d75422eaaa05490d0b9a5e328fc1a51"}], "title": "btrfs: free exchange changeset on failures", "x_generator": {"engine": "bippy-a5840b7849dd"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.770Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ca06c5cb1b6dbfe67655b33c02fc394d65824519", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/da5e817d9d75422eaaa05490d0b9a5e328fc1a51", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47508", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:35:39.656794Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:22.299Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ca06c5cb1b6dbfe67655b33c02fc394d65824519", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/da5e817d9d75422eaaa05490d0b9a5e328fc1a51", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.770Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47508", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:35:39.656794Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:16.372Z"}}], "cna": {"title": "btrfs: free exchange changeset on failures", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "ca06c5cb1b6d", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "da5e817d9d75", "versionType": "git"}], "programFiles": ["fs/btrfs/delalloc-space.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "5.15.8", "versionType": "custom", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/btrfs/delalloc-space.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ca06c5cb1b6dbfe67655b33c02fc394d65824519"}, {"url": "https://git.kernel.org/stable/c/da5e817d9d75422eaaa05490d0b9a5e328fc1a51"}], "x_generator": {"engine": "bippy-a5840b7849dd"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free exchange changeset on failures\n\nFstests runs on my VMs have show several kmemleak reports like the following.\n\n unreferenced object 0xffff88811ae59080 (size 64):\n comm \"xfs_io\", pid 12124, jiffies 4294987392 (age 6.368s)\n hex dump (first 32 bytes):\n 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................\n 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................\n backtrace:\n [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs]\n [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs]\n [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs]\n [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs]\n [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs]\n [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs]\n [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs]\n [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs]\n [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0\n [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700\n [<000000002567ba53>] iomap_dio_rw+0x5/0x20\n [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs]\n [<000000005eb3d845>] new_sync_write+0x106/0x180\n [<000000003fb505bf>] vfs_write+0x24d/0x2f0\n [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0\n [<000000003eba3fdf>] do_syscall_64+0x43/0x90\n\nIn case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata()\nfail the allocated extent_changeset will not be freed.\n\nSo in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space()\nfree the allocated extent_changeset to get rid of the allocated memory.\n\nThe issue currently only happens in the direct IO write path, but only\nafter 65b3c08606e5 (\"btrfs: fix ENOSPC failure when attempting direct IO\nwrite into NOCOW range\"), and also at defrag_one_locked_target(). Every\nother place is always calling extent_changeset_free() even if its call\nto btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has\nfailed."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:09:11.002Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47508", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:33:22.299Z", "dateReserved": "2024-05-22T06:20:56.206Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-24T15:01:54.048Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free exchange changeset on failures\n\nFstests runs on my VMs have show several kmemleak reports like the following.\n\n unreferenced object 0xffff88811ae59080 (size 64):\n comm \"xfs_io\", pid 12124, jiffies 4294987392 (age 6.368s)\n hex dump (first 32 bytes):\n 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................\n 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................\n backtrace:\n [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs]\n [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs]\n [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs]\n [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs]\n [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs]\n [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs]\n [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs]\n [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs]\n [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0\n [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700\n [<000000002567ba53>] iomap_dio_rw+0x5/0x20\n [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs]\n [<000000005eb3d845>] new_sync_write+0x106/0x180\n [<000000003fb505bf>] vfs_write+0x24d/0x2f0\n [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0\n [<000000003eba3fdf>] do_syscall_64+0x43/0x90\n\nIn case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata()\nfail the allocated extent_changeset will not be freed.\n\nSo in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space()\nfree the allocated extent_changeset to get rid of the allocated memory.\n\nThe issue currently only happens in the direct IO write path, but only\nafter 65b3c08606e5 (\"btrfs: fix ENOSPC failure when attempting direct IO\nwrite into NOCOW range\"), and also at defrag_one_locked_target(). Every\nother place is always calling extent_changeset_free() even if its call\nto btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has\nfailed."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: btrfs: conjunto de cambios de intercambio gratuito en caso de fallas. Las ejecuciones de Fstests en mis VM han mostrado varios informes de kmemleak como el siguiente. objeto sin referencia 0xffff88811ae59080 (tama\u00f1o 64): comm \"xfs_io\", pid 12124, jiffies 4294987392 (edad 6,368 s) volcado hexadecimal (primeros 32 bytes): 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00... ............. 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................ retroceso: [&lt;00000000ac0176d2 &gt;] ulist_add_merge+0x60/0x150 [btrfs] [&lt;0000000076e9f312&gt;] set_state_bits+0x86/0xc0 [btrfs] [&lt;0000000014fe73d6&gt;] set_extent_bit+0x270/0x690 [btrfs] [&lt;000000004f 675208&gt;] set_record_extent_bits+0x19/0x20 [btrfs] [ &lt;00000000b96137b1&gt;] qgroup_reserve_data+0x274/0x310 [btrfs] [&lt;0000000057e9dcbb&gt;] btrfs_check_data_free_space+0x5c/0xa0 [btrfs] [&lt;0000000019c4511d&gt;] +0x1b/0xa0 [btrfs] [&lt;000000006d37e007&gt;] btrfs_dio_iomap_begin+0x415/0x970 [btrfs ] [&lt;00000000fb8a74b8&gt;] iomap_iter+0x161/0x1e0 [&lt;0000000071dff6ff&gt;] __iomap_dio_rw+0x1df/0x700 [&lt;000000002567ba53&gt;] iomap_dio_rw+0x5/0x20 [&lt;000000 0072e555f8&gt;] btrfs_file_write_iter+0x290/0x530 [btrfs] [&lt;000000005eb3d845&gt;] new_sync_write +0x106/0x180 [&lt;000000003fb505bf&gt;] vfs_write+0x24d/0x2f0 [&lt;000000009bb57d37&gt;] __x64_sys_pwrite64+0x69/0xa0 [&lt;000000003eba3fdf&gt;] 3/0x90 En caso de que brtfs_qgroup_reserve_data() o btrfs_delalloc_reserve_metadata() fallen, el conjunto de cambios asignado no ser\u00e1 liberado. Entonces, en btrfs_check_data_free_space() y btrfs_delalloc_reserve_space() libera el extend_changeset asignado para deshacerte de la memoria asignada. Actualmente, el problema solo ocurre en la ruta de escritura de IO directa, pero solo despu\u00e9s de 65b3c08606e5 (\"btrfs: corrige la falla de ENOSPC al intentar escribir IO directa en el rango NOCOW\"), y tambi\u00e9n en defrag_one_locked_target(). Todos los dem\u00e1s lugares siempre llaman a extend_changeset_free() incluso si su llamada a btrfs_delalloc_reserve_space() o btrfs_check_data_free_space() ha fallado."}], "id": "CVE-2021-47508", "lastModified": "2024-05-24T18:09:20.027", "metrics": {}, "published": "2024-05-24T15:15:11.573", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ca06c5cb1b6dbfe67655b33c02fc394d65824519"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/da5e817d9d75422eaaa05490d0b9a5e328fc1a51"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: btrfs: free exchange changeset on failures", "id": "2283444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283444"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-401", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbtrfs: free exchange changeset on failures\nFstests runs on my VMs have show several kmemleak reports like the following.\nunreferenced object 0xffff88811ae59080 (size 64):\ncomm \"xfs_io\", pid 12124, jiffies 4294987392 (age 6.368s)\nhex dump (first 32 bytes):\n00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................\n90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................\nbacktrace:\n[<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs]\n[<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs]\n[<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs]\n[<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs]\n[<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs]\n[<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs]\n[<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs]\n[<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs]\n[<00000000fb8a74b8>] iomap_iter+0x161/0x1e0\n[<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700\n[<000000002567ba53>] iomap_dio_rw+0x5/0x20\n[<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs]\n[<000000005eb3d845>] new_sync_write+0x106/0x180\n[<000000003fb505bf>] vfs_write+0x24d/0x2f0\n[<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0\n[<000000003eba3fdf>] do_syscall_64+0x43/0x90\nIn case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata()\nfail the allocated extent_changeset will not be freed.\nSo in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space()\nfree the allocated extent_changeset to get rid of the allocated memory.\nThe issue currently only happens in the direct IO write path, but only\nafter 65b3c08606e5 (\"btrfs: fix ENOSPC failure when attempting direct IO\nwrite into NOCOW range\"), and also at defrag_one_locked_target(). Every\nother place is always calling extent_changeset_free() even if its call\nto btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has\nfailed."], "name": "CVE-2021-47508", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47508\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47508\nhttps://lore.kernel.org/linux-cve-announce/2024052453-CVE-2021-47508-1a19@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 5.15.8, kernel 5.16"}