{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47004", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-27T18:42:55.951Z", "datePublished": "2024-02-28T08:13:25.324Z", "dateUpdated": "2026-08-05T08:45:31.112Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:31.112Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid touching checkpointed data in get_victim()\n\nIn CP disabling mode, there are two issues when using LFS or SSR | AT_SSR\nmode to select victim:\n\n1. LFS is set to find source section during GC, the victim should have\nno checkpointed data, since after GC, section could not be set free for\nreuse.\n\nPreviously, we only check valid chpt blocks in current segment rather\nthan section, fix it.\n\n2. SSR | AT_SSR are set to find target segment for writes which can be\nfully filled by checkpointed and newly written blocks, we should never\nselect such segment, otherwise it can cause panic or data corruption\nduring allocation, potential case is described as below:\n\n a) target segment has 'n' (n < 512) ckpt valid blocks\n b) GC migrates 'n' valid blocks to other segment (segment is still\n in dirty list)\n c) GC migrates '512 - n' blocks to target segment (segment has 'n'\n cp_vblocks and '512 - n' vblocks)\n d) If GC selects target segment via {AT,}SSR allocator, however there\n is no free space in targe segment." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is in f2fs GC/SSR victim selection and is reached via local filesystem operations (writes triggering f2fs_balance_fs/SSR allocation or the local GC path), not via network packet processing.\nAC:L - With checkpoint disabled, f2fs_need_SSR() always forces SSR and an attacker who can write can drive GC/allocation until a full dirty segment is selected; success does not depend on a race or other attacker-uncontrollable conditions.\nPR:L - Mounting with checkpoint=disable is an admin/deployment precondition, but once that mode is active any unprivileged user with write access triggers the vulnerable get_victim/SSR path through ordinary writes without CAP_SYS_ADMIN.\nUI:N - Exploitation requires only the attacker’s own writes on an already checkpoint-disabled f2fs mount; no separate victim interaction is required.\nS:U - Impact is confined to the local kernel/filesystem authority (panic and filesystem corruption); it does not cross a VM, IOMMU, or other security boundary.\nC:N - The failure is a logic/allocation bug that panics or corrupts filesystem metadata (summary/SIT/block placement); it does not provide an information-disclosure or arbitrary-read primitive.\nI:H - Selecting a full segment for SSR can corrupt on-disk data and metadata during allocation (wrong block reuse and summary/journal corruption), which the fix commit explicitly describes as data corruption.\nA:H - Allocation with next_blkoff >= blocks_per_seg hits f2fs_bug_on (BUG_ON under CONFIG_F2FS_CHECK_FS, otherwise WARN and continued broken state), causing kernel oops/panic or filesystem failure." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/f2fs.h", "fs/f2fs/gc.c", "fs/f2fs/segment.c", "fs/f2fs/segment.h" ], "versions": [ { "version": "4354994f097d068a894aa1a0860da54571df3582", "lessThan": "105155a8146ddb54c119d8318964eef3859d109d", "status": "affected", "versionType": "git" }, { "version": "4354994f097d068a894aa1a0860da54571df3582", "lessThan": "1e116f87825f01a6380286472196882746b16f63", "status": "affected", "versionType": "git" }, { "version": "4354994f097d068a894aa1a0860da54571df3582", "lessThan": "211372b2571520e394b56b431a0705586013b3ff", "status": "affected", "versionType": "git" }, { "version": "4354994f097d068a894aa1a0860da54571df3582", "lessThan": "61461fc921b756ae16e64243f72af2bfc2e620db", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/f2fs.h", "fs/f2fs/gc.c", "fs/f2fs/segment.c", "fs/f2fs/segment.h" ], "versions": [ { "version": "4.20", "status": "affected" }, { "version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.38", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.11.22", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.12.5", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.38" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.11.22" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.12.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/105155a8146ddb54c119d8318964eef3859d109d" }, { "url": "https://git.kernel.org/stable/c/1e116f87825f01a6380286472196882746b16f63" }, { "url": "https://git.kernel.org/stable/c/211372b2571520e394b56b431a0705586013b3ff" }, { "url": "https://git.kernel.org/stable/c/61461fc921b756ae16e64243f72af2bfc2e620db" } ], "title": "f2fs: fix to avoid touching checkpointed data in get_victim()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.238Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/105155a8146ddb54c119d8318964eef3859d109d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1e116f87825f01a6380286472196882746b16f63", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/211372b2571520e394b56b431a0705586013b3ff", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/61461fc921b756ae16e64243f72af2bfc2e620db", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-47004", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:58:19.064167Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:34.294Z" } } ] } }