Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47343— dm btree remove: assign new_root only when removal succeeds

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于IO读取错误。

CVSS 7.8 · High EPSS 0.27% · P18

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4< 4c84b3e0728ffe10d89c633694c35a02b5c477dc affected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4< c154775619186781aaf8a99333ac07437a1768d5 affected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4< 73f27adaa73e3057a9ec464e33c4f54d34ea5de3 affected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4< 8fbae4a1bdb5b889490cdee929e68540151536e5 affected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4< 964d57d1962d7e68f0f578f05d9ae4a104d74851 affected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4< ba47e65a5de3e0e8270301a409fc63d3129fdb9e affected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4< 89bf942314b78d454db92427201421b5dec132d9 affected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4< ad365e9351ac2b450e7e79932ff6abf59342d91a affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47343

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
dm btree remove: assign new_root only when removal succeeds
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: dm btree remove: assign new_root only when removal succeeds remove_raw() in dm_btree_remove() may fail due to IO read error (e.g. read the content of origin block fails during shadowing), and the value of shadow_spine::root is uninitialized, but the uninitialized value is still assign to new_root in the end of dm_btree_remove(). For dm-thin, the value of pmd->details_root or pmd->root will become an uninitialized value, so if trying to read details_info tree again out-of-bound memory may occur as showed below: general protection fault, probably for non-canonical address 0x3fdcb14c8d7520 CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6 Hardware name: QEMU Standard PC RIP: 0010:metadata_ll_load_ie+0x14/0x30 Call Trace: sm_metadata_count_is_more_than_one+0xb9/0xe0 dm_tm_shadow_block+0x52/0x1c0 shadow_step+0x59/0xf0 remove_raw+0xb2/0x170 dm_btree_remove+0xf4/0x1c0 dm_pool_delete_thin_device+0xc3/0x140 pool_message+0x218/0x2b0 target_message+0x251/0x290 ctl_ioctl+0x1c4/0x4d0 dm_ctl_ioctl+0xe/0x20 __x64_sys_ioctl+0x7b/0xb0 do_syscall_64+0x40/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixing it by only assign new_root when removal succeeds
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于IO读取错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 ~ 4c84b3e0728ffe10d89c633694c35a02b5c477dc -
Linux Linux 3.2 -

II. Public POCs for CVE-2021-47343

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47343

请登录查看更多情报信息。

Other References for CVE-2021-47343 (9)

Same Patch Batch · Linux · 2024-05-21 · 361 CVEs total

CVE-2023-52732 9.8 CRITICAL ceph: blocklist the kclient when receiving corrupted snap trace
CVE-2023-52755 9.8 CRITICAL ksmbd: fix slab out of bounds write in smb_inherit_dacl()
CVE-2021-47378 9.8 CRITICAL nvme-rdma: destroy cm id before destroy qp to avoid use after free
CVE-2021-47328 9.8 CRITICAL scsi: iscsi: Fix conn use after free during resets
CVE-2021-47232 9.8 CRITICAL can: j1939: fix Use-after-Free, hold skb ref while in use
CVE-2023-52741 9.8 CRITICAL cifs: Fix use-after-free in rdata->read_into_pages()
CVE-2021-47427 9.8 CRITICAL scsi: iscsi: Fix iscsi_task use after free
CVE-2021-47308 8.8 HIGH scsi: libfc: Fix array index out of bound exception
CVE-2023-52776 8.8 HIGH wifi: ath12k: fix dfs-radar and temperature event locking
CVE-2021-47388 8.8 HIGH mac80211: fix use-after-free in CCMP/GCMP RX
CVE-2023-52801 8.8 HIGH iommufd: Fix missing update of domains_itree after splitting iopt_area
CVE-2023-52798 8.8 HIGH wifi: ath11k: fix dfs radar event locking
CVE-2021-47390 8.8 HIGH KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()
CVE-2023-52769 8.8 HIGH wifi: ath12k: fix htt mlo-offset event locking
CVE-2023-52846 8.8 HIGH hsr: Prevent use after free in prp_create_tagged_frame()
CVE-2023-52790 8.8 HIGH swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC
CVE-2021-47240 8.4 HIGH net: qrtr: fix OOB Read in qrtr_endpoint_post
CVE-2021-47352 8.4 HIGH virtio-net: Add validation for used length
CVE-2023-52829 8.4 HIGH wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps()
CVE-2021-47244 8.2 HIGH mptcp: Fix out of bounds when parsing TCP options

Showing top 20 of 361 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47343

No comments yet

Leave a comment