Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47460— ocfs2: fix data corruption after conversion from inline format

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于从内联格式转换后会导致数据损坏。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 22

VendorProduct Version RangeStatus
Linux Linux acef5107e2eacb08a16ad5db60320d65bd26a6c0< 560edd14de2bf9dbc0129681eeb4d5ef87cc105f affected
7ed80e77c908cbaa686529a49f8ae0060c5caee7< 8e6bfb4f70168ddfd32fb6dc028ad52faaf1f32e affected
7ce2b16bad2cbfa3fa7bbc42c4448914f639ca47< a3a089c241cd49b33a8cdd7fcb37cc87a086912a affected
f8a6a2ed4b7d1c3c8631eeb6d00572bc853094a8< b05caf023b14cbed9223bb5b48ecc7bffe38f632 affected
6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b< f1b98569e81c37d7e0deada7172f8f60860c1360 affected
6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b< fa9b6b6c953e3f6441ed6cf83b4c771dac2dae08 affected
6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b< 5314454ea3ff6fc746eaf71b9a7ceebed52888fa affected
36ed9e604215f58cec0381ca5fcc6da05f2d87ca affected
… +14 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47460

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ocfs2: fix data corruption after conversion from inline format
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after conversion from inline format Commit 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()") uncovered a latent bug in ocfs2 conversion from inline inode format to a normal inode format. The code in ocfs2_convert_inline_data_to_extents() attempts to zero out the whole cluster allocated for file data by grabbing, zeroing, and dirtying all pages covering this cluster. However these pages are beyond i_size, thus writeback code generally ignores these dirty pages and no blocks were ever actually zeroed on the disk. This oversight was fixed by commit 693c241a5f6a ("ocfs2: No need to zero pages past i_size.") for standard ocfs2 write path, inline conversion path was apparently forgotten; the commit log also has a reasoning why the zeroing actually is not needed. After commit 6dbf7bb55598, things became worse as writeback code stopped invalidating buffers on pages beyond i_size and thus these pages end up with clean PageDirty bit but with buffers attached to these pages being still dirty. So when a file is converted from inline format, then writeback triggers, and then the file is grown so that these pages become valid, the invalid dirtiness state is preserved, mark_buffer_dirty() does nothing on these pages (buffers are already dirty) but page is never written back because it is clean. So data written to these pages is lost once pages are reclaimed. Simple reproducer for the problem is: xfs_io -f -c "pwrite 0 2000" -c "pwrite 2000 2000" -c "fsync" \ -c "pwrite 4000 2000" ocfs2_file After unmounting and mounting the fs again, you can observe that end of 'ocfs2_file' has lost its contents. Fix the problem by not doing the pointless zeroing during conversion from inline format similarly as in the standard write path. [akpm@linux-foundation.org: fix whitespace, per Joseph]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于从内联格式转换后会导致数据损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux acef5107e2eacb08a16ad5db60320d65bd26a6c0 ~ 560edd14de2bf9dbc0129681eeb4d5ef87cc105f -
Linux Linux 5.10 -

II. Public POCs for CVE-2021-47460

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47460

请登录查看更多情报信息。

Other References for CVE-2021-47460 (5)

Same Patch Batch · Linux · 2024-05-22 · 63 CVEs total

CVE-2021-47496 9.8 CRITICAL net/tls: Fix flipped sign in tls_err_abort() calls
CVE-2021-47478 9.1 CRITICAL isofs: Fix out of bound access for corrupted isofs image
CVE-2021-47450 8.8 HIGH KVM: arm64: Fix host stage-2 PGD refcount
CVE-2021-47433 8.1 HIGH btrfs: fix abort logic in btrfs_replace_file_extents
CVE-2021-47446 7.8 HIGH drm/msm/a4xx: fix error handling in a4xx_gpu_init()
CVE-2021-47493 7.8 HIGH ocfs2: fix race between searching chunks and release journal_head from buffer_head
CVE-2021-47492 7.8 HIGH mm, thp: bail out early in collapse_file for writeback page
CVE-2021-47494 7.8 HIGH cfg80211: fix management registrations locking
CVE-2021-47451 7.8 HIGH netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value
CVE-2021-47447 7.8 HIGH drm/msm/a3xx: fix error handling in a3xx_gpu_init()
CVE-2021-47485 7.8 HIGH IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
CVE-2021-47483 7.8 HIGH regmap: Fix possible double-free in regcache_rbtree_exit()
CVE-2021-47459 7.8 HIGH can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
CVE-2021-47461 7.8 HIGH userfaultfd: fix a race between writeprotect and exit_mmap()
CVE-2021-47448 7.5 HIGH mptcp: fix possible stall on recvmsg()
CVE-2021-47438 7.1 HIGH net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path
CVE-2021-47465 7.1 HIGH KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
CVE-2021-47458 7.1 HIGH ocfs2: mount fails with buffer overflow in strlen
CVE-2021-47497 nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
CVE-2021-47498 dm rq: don't queue request to blk-mq during DM suspend

Showing top 20 of 63 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47460

No comments yet

Leave a comment