CVE-2021-47433 (GCVE-0-2021-47433)
Vulnerability from cvelistv5
Published
2024-05-22 06:19
Modified
2026-08-05 08:47
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix abort logic in btrfs_replace_file_extents Error injection testing uncovered a case where we'd end up with a corrupt file system with a missing extent in the middle of a file. This occurs because the if statement to decide if we should abort is wrong. The only way we would abort in this case is if we got a ret != -EOPNOTSUPP and we called from the file clone code. However the prealloc code uses this path too. Instead we need to abort if there is an error, and the only error we _don't_ abort on is -EOPNOTSUPP and only if we came from the clone file code.
References
Impacted products
Vendor Product Version
Linux Linux Version: 8fccebfa534c7984864394fa03608305e4929aae
Version: 8fccebfa534c7984864394fa03608305e4929aae
Version: 8fccebfa534c7984864394fa03608305e4929aae
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47433",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-10T18:56:43.265826Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-10T18:57:31.785Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.455Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e32a2b85c7d92ece86c17dfef390c5ed79c6378",
              "status": "affected",
              "version": "8fccebfa534c7984864394fa03608305e4929aae",
              "versionType": "git"
            },
            {
              "lessThan": "0e309e1152fc34ef75991d9d69b165dbf75bf26c",
              "status": "affected",
              "version": "8fccebfa534c7984864394fa03608305e4929aae",
              "versionType": "git"
            },
            {
              "lessThan": "4afb912f439c4bc4e6a4f3e7547f2e69e354108f",
              "status": "affected",
              "version": "8fccebfa534c7984864394fa03608305e4929aae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.75",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.14",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix abort logic in btrfs_replace_file_extents\n\nError injection testing uncovered a case where we\u0027d end up with a\ncorrupt file system with a missing extent in the middle of a file.  This\noccurs because the if statement to decide if we should abort is wrong.\n\nThe only way we would abort in this case is if we got a ret !=\n-EOPNOTSUPP and we called from the file clone code.  However the\nprealloc code uses this path too.  Instead we need to abort if there is\nan error, and the only error we _don\u0027t_ abort on is -EOPNOTSUPP and only\nif we came from the clone file code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable prealloc path is reachable remotely via NFSv4 ALLOCATE (nfsd4_allocate \u2192 vfs_fallocate \u2192 btrfs_fallocate \u2192 insert_prealloc_file_extent \u2192 btrfs_replace_file_extents) when nfsd exports a btrfs filesystem, a common server deployment.\nAC:L - An attacker who can issue fallocate/ALLOCATE against a writable btrfs file drives the vulnerable path directly; inducing a mid-drop failure (for example via memory/metadata pressure) does not require a race or other condition outside the attacker\u2019s influence.\nPR:L - Exploitation needs only write access to a regular file on btrfs (local fallocate or an NFS write stateid); root or init-namespace capabilities are not required.\nUI:N - No victim action is needed beyond the already-mounted/exported btrfs filesystem; the attacker triggers the bug solely through fallocate/ALLOCATE.\nS:U - Impact is confined to the host kernel\u2019s btrfs instance (on-disk corruption / filesystem disruption) and does not cross a VM, IOMMU, or other security authority boundary.\nC:N - The bug leaves missing file extent items (holes/data loss), not an out-of-bounds or UAF read primitive, so it does not disclose arbitrary kernel or other users\u2019 data.\nI:H - On error after extents are dropped, the transaction is not aborted and can commit, producing durable filesystem corruption with missing extents in the middle of a file, which is a high integrity impact on stored data and FS metadata.\nA:H - Committed missing-extent corruption can break subsequent reads/FS operations and destabilize the shared filesystem for all users of that volume, constituting a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:47.653Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f"
        }
      ],
      "title": "btrfs: fix abort logic in btrfs_replace_file_extents",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47433",
    "datePublished": "2024-05-22T06:19:30.244Z",
    "dateReserved": "2024-05-21T14:58:30.830Z",
    "dateUpdated": "2026-08-05T08:47:47.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.455Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47433\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-10T18:56:43.265826Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-10T18:57:27.813Z\"}}], \"cna\": {\"title\": \"btrfs: fix abort logic in btrfs_replace_file_extents\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable prealloc path is reachable remotely via NFSv4 ALLOCATE (nfsd4_allocate \\u2192 vfs_fallocate \\u2192 btrfs_fallocate \\u2192 insert_prealloc_file_extent \\u2192 btrfs_replace_file_extents) when nfsd exports a btrfs filesystem, a common server deployment.\\nAC:L - An attacker who can issue fallocate/ALLOCATE against a writable btrfs file drives the vulnerable path directly; inducing a mid-drop failure (for example via memory/metadata pressure) does not require a race or other condition outside the attacker\\u2019s influence.\\nPR:L - Exploitation needs only write access to a regular file on btrfs (local fallocate or an NFS write stateid); root or init-namespace capabilities are not required.\\nUI:N - No victim action is needed beyond the already-mounted/exported btrfs filesystem; the attacker triggers the bug solely through fallocate/ALLOCATE.\\nS:U - Impact is confined to the host kernel\\u2019s btrfs instance (on-disk corruption / filesystem disruption) and does not cross a VM, IOMMU, or other security authority boundary.\\nC:N - The bug leaves missing file extent items (holes/data loss), not an out-of-bounds or UAF read primitive, so it does not disclose arbitrary kernel or other users\\u2019 data.\\nI:H - On error after extents are dropped, the transaction is not aborted and can commit, producing durable filesystem corruption with missing extents in the middle of a file, which is a high integrity impact on stored data and FS metadata.\\nA:H - Committed missing-extent corruption can break subsequent reads/FS operations and destabilize the shared filesystem for all users of that volume, constituting a high availability impact.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8fccebfa534c7984864394fa03608305e4929aae\", \"lessThan\": \"0e32a2b85c7d92ece86c17dfef390c5ed79c6378\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8fccebfa534c7984864394fa03608305e4929aae\", \"lessThan\": \"0e309e1152fc34ef75991d9d69b165dbf75bf26c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8fccebfa534c7984864394fa03608305e4929aae\", \"lessThan\": \"4afb912f439c4bc4e6a4f3e7547f2e69e354108f\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/file.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.75\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/file.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378\"}, {\"url\": \"https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c\"}, {\"url\": \"https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix abort logic in btrfs_replace_file_extents\\n\\nError injection testing uncovered a case where we\u0027d end up with a\\ncorrupt file system with a missing extent in the middle of a file.  This\\noccurs because the if statement to decide if we should abort is wrong.\\n\\nThe only way we would abort in this case is if we got a ret !=\\n-EOPNOTSUPP and we called from the file clone code.  However the\\nprealloc code uses this path too.  Instead we need to abort if there is\\nan error, and the only error we _don\u0027t_ abort on is -EOPNOTSUPP and only\\nif we came from the clone file code.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.75\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.14\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:47:47.653Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47433\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:47:47.653Z\", \"dateReserved\": \"2024-05-21T14:58:30.830Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-22T06:19:30.244Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.