CVE-2021-47113CWE-416

CVE-2021-47113

High · published March 16, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

btrfs: abort in rename_exchange if we fail to insert the second ref

Error injection stress uncovered a problem where we'd leave a dangling

inode ref if we failed during a rename_exchange. This happens because

we insert the inode ref for one side of the rename, and then for the

other side. If this second inode ref insert fails we'll leave the first

one dangling and leave a corrupt file system behind. Fix this by

aborting if we did the insert for the first inode ref.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.3th percentile
Weakness
CWE-416 · Use After Free
Published
2024-03-16T01:15Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel< 5.10.435.10.43
linux/linux_kernel≥ 5.11, < 5.12.105.12.10
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (6)
https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 15 MAR 20:14Z
    btrfs: abort in rename_exchange if we fail to insert the second ref
    cvelistv5