CVE-2021-47656

一、漏洞信息
 漏洞编号：[CVE-2021-47656](https://nvd.nist.gov/vuln/detail/CVE-2021-47656)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:jffs2: fix use-after-free in jffs2_clear_xattr_subsystemWhen we mount a jffs2 image, assume that the first few blocks ofthe image are normal and contain at least one xattr-related inode,but the next block is abnormal. As a result, an error is returnedin jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is thencalled in jffs2_build_filesystem() and then again injffs2_do_fill_super().Finally we can observe the following report: ================================================================== BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac Read of size 8 at addr ffff8881243384e0 by task mount/719 Call Trace:  dump_stack+0x115/0x16b  jffs2_clear_xattr_subsystem+0x95/0x6ac  jffs2_do_fill_super+0x84f/0xc30  jffs2_fill_super+0x2ea/0x4c0  mtd_get_sb+0x254/0x400  mtd_get_sb_by_nr+0x4f/0xd0  get_tree_mtd+0x498/0x840  jffs2_get_tree+0x25/0x30  vfs_get_tree+0x8d/0x2e0  path_mount+0x50f/0x1e50  do_mount+0x107/0x130  __se_sys_mount+0x1c5/0x2f0  __x64_sys_mount+0xc7/0x160  do_syscall_64+0x45/0x70  entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 719:  kasan_save_stack+0x23/0x60  __kasan_kmalloc.constprop.0+0x10b/0x120  kasan_slab_alloc+0x12/0x20  kmem_cache_alloc+0x1c0/0x870  jffs2_alloc_xattr_ref+0x2f/0xa0  jffs2_scan_medium.cold+0x3713/0x4794  jffs2_do_mount_fs.cold+0xa7/0x2253  jffs2_do_fill_super+0x383/0xc30  jffs2_fill_super+0x2ea/0x4c0 [...] Freed by task 719:  kmem_cache_free+0xcc/0x7b0  jffs2_free_xattr_ref+0x78/0x98  jffs2_clear_xattr_subsystem+0xa1/0x6ac  jffs2_do_mount_fs.cold+0x5e6/0x2253  jffs2_do_fill_super+0x383/0xc30  jffs2_fill_super+0x2ea/0x4c0 [...] The buggy address belongs to the object at ffff8881243384b8  which belongs to the cache jffs2_xattr_ref of size 48 The buggy address is located 40 bytes inside of  48-byte region [ffff8881243384b8, ffff8881243384e8) [...] ==================================================================The triggering of the BUG is shown in the following stack:-----------------------------------------------------------jffs2_fill_super  jffs2_do_fill_super    jffs2_do_mount_fs      jffs2_build_filesystem        jffs2_scan_medium          jffs2_scan_eraseblock        <--- ERROR        jffs2_clear_xattr_subsystem    <--- free    jffs2_clear_xattr_subsystem        <--- free again-----------------------------------------------------------An error is returned in jffs2_do_mount_fs(). If the error is returnedby jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need tobe executed. If the error is returned by jffs2_build_filesystem(), thejffs2_clear_xattr_subsystem() also does not need to be executed again.So move jffs2_clear_xattr_subsystem() from  out_inohash  to  out_root to fix this UAF problem.
 漏洞公开时间：2025-02-26 14:37:07
 漏洞创建时间：2025-02-26 16:54:33
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-47656
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47656 | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2021/CVE-2021-47656.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |
| suse_bugzilla | https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9 | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |
| suse_bugzilla | https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5 | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |
| suse_bugzilla | https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101 | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |
| suse_bugzilla | https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422 | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |
| suse_bugzilla | https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13 | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |
| suse_bugzilla | https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1 | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |
| suse_bugzilla | https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44 | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |
| suse_bugzilla | https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |
| suse_bugzilla | https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5c | https://bugzilla.suse.com/show_bug.cgi?id=1237827 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44 |  | nvd |
|  |  | https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422 |  | nvd |
|  |  | https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5 |  | nvd |
|  |  | https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5c |  | nvd |
|  |  | https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13 |  | nvd |
|  |  | https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed |  | nvd |
|  |  | https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:jffs2: fix use-after-free in jffs2_clear_xattr_subsystemWhen we mount a jffs2 image, assume that the first few blocks ofthe image are normal and contain at least one xattr-related inode,but the next block is abnormal. As a result, an error is returnedin jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is thencalled in jffs2_build_filesystem() and then again injffs2_do_fill_super().Finally we can observe the following report: ================================================================== BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac Read of size 8 at addr ffff8881243384e0 by task mount/719 Call Trace:  dump_stack+0x115/0x16b  jffs2_clear_xattr_subsystem+0x95/0x6ac  jffs2_do_fill_super+0x84f/0xc30  jffs2_fill_super+0x2ea/0x4c0  mtd_get_sb+0x254/0x400  mtd_get_sb_by_nr+0x4f/0xd0  get_tree_mtd+0x498/0x840  jffs2_get_tree+0x25/0x30  vfs_get_tree+0x8d/0x2e0  path_mount+0x50f/0x1e50  do_mount+0x107/0x130  __se_sys_mount+0x1c5/0x2f0  __x64_sys_mount+0xc7/0x160  do_syscall_64+0x45/0x70  entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 719:  kasan_save_stack+0x23/0x60  __kasan_kmalloc.constprop.0+0x10b/0x120  kasan_slab_alloc+0x12/0x20  kmem_cache_alloc+0x1c0/0x870  jffs2_alloc_xattr_ref+0x2f/0xa0  jffs2_scan_medium.cold+0x3713/0x4794  jffs2_do_mount_fs.cold+0xa7/0x2253  jffs2_do_fill_super+0x383/0xc30  jffs2_fill_super+0x2ea/0x4c0 [...] Freed by task 719:  kmem_cache_free+0xcc/0x7b0  jffs2_free_xattr_ref+0x78/0x98  jffs2_clear_xattr_subsystem+0xa1/0x6ac  jffs2_do_mount_fs.cold+0x5e6/0x2253  jffs2_do_fill_super+0x383/0xc30  jffs2_fill_super+0x2ea/0x4c0 [...] The buggy address belongs to the object at ffff8881243384b8  which belongs to the cache jffs2_xattr_ref of size 48 The buggy address is located 40 bytes inside of  48-byte region [ffff8881243384b8, ffff8881243384e8) [...] ==================================================================The triggering of the BUG is shown in the following stack:-----------------------------------------------------------jffs2_fill_super  jffs2_do_fill_super    jffs2_do_mount_fs      jffs2_build_filesystem        jffs2_scan_medium          jffs2_scan_eraseblock        <--- ERROR        jffs2_clear_xattr_subsystem    <--- free    jffs2_clear_xattr_subsystem        <--- free again-----------------------------------------------------------An error is returned in jffs2_do_mount_fs(). If the error is returnedby jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need tobe executed. If the error is returned by jffs2_build_filesystem(), thejffs2_clear_xattr_subsystem() also does not need to be executed again.So move jffs2_clear_xattr_subsystem() from  out_inohash  to  out_root to fix this UAF problem.
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):不受影响
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler/kernel

Content Risk Flag

Comments (20)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2021-47656

Comments (20)

Search

src-openEuler/kernel