{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47351", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T14:28:16.985Z", "datePublished": "2024-05-21T14:35:55.806Z", "dateUpdated": "2026-08-05T08:47:23.774Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:47:23.774Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix races between xattr_{set|get} and listxattr operations\n\nUBIFS may occur some problems with concurrent xattr_{set|get} and\nlistxattr operations, such as assertion failure, memory corruption,\nstale xattr value[1].\n\nFix it by importing a new rw-lock in @ubifs_inode to serilize write\noperations on xattr, concurrent read operations are still effective,\njust like ext4.\n\n[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached via local setxattr/getxattr/listxattr syscalls into UBIFS xattr handlers on a mounted filesystem, not via network packet processing or physical device attachment.\nAC:L - The attacker controls both sides of the race by running concurrent setxattr and listxattr threads against the same inode and can retry indefinitely until the size check is bypassed, so success does not depend on conditions outside attacker influence.\nPR:L - An unprivileged local user who can create or write a regular file on a mounted UBIFS volume can set user.* xattrs and list them; no root or init-namespace capabilities are required.\nUI:N - UBIFS is commonly already mounted as root or data storage on embedded, IoT, and similar devices; the attacker drives setxattr/listxattr from their own processes with no victim mount or open required.\nS:U - Impact is confined to the host kernel heap and UBIFS mount within the same OS security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Racing listxattr against setxattr causes an out-of-bounds write into the kernel kvmalloc list buffer, which is heap memory corruption that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The overflow copies attacker-chosen xattr name bytes past the end of the kernel buffer, yielding a controlled heap write primitive suitable for corruption and privilege escalation.\nA:H - The same race triggers ubifs_assert failures (default remount-ro, optionally panic) and heap corruption that can oops/panic the kernel, denying availability of the system or filesystem." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ubifs/super.c", "fs/ubifs/ubifs.h", "fs/ubifs/xattr.c" ], "versions": [ { "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d", "lessThan": "7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08", "status": "affected", "versionType": "git" }, { "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d", "lessThan": "38dde03eb239605f428f3f1e4baa73d4933a4cc6", "status": "affected", "versionType": "git" }, { "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d", "lessThan": "9558612cb829f2c022b788f55d6b8437d5234a82", "status": "affected", "versionType": "git" }, { "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d", "lessThan": "c0756f75c22149d20fcb7d8409827cee905eb386", "status": "affected", "versionType": "git" }, { "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d", "lessThan": "f4e3634a3b642225a530c292fdb1e8a4007507f5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ubifs/super.c", "fs/ubifs/ubifs.h", "fs/ubifs/xattr.c" ], "versions": [ { "version": "2.6.27", "status": "affected" }, { "version": "0", "lessThan": "2.6.27", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.133", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.51", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.12.18", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.13.3", "lessThanOrEqual": "5.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.4.133" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.10.51" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.12.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.13.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08" }, { "url": "https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6" }, { "url": "https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82" }, { "url": "https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386" }, { "url": "https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5" } ], "title": "ubifs: Fix races between xattr_{set|get} and listxattr operations", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-11T19:01:36.389057Z", "id": "CVE-2021-47351", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T19:01:45.807Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.560Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5", "tags": [ "x_transferred" ] } ] } ] } }