CVE-2021-47638
- Source
- https://cve.org/CVERecord?id=CVE-2021-47638
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-47638.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-47638
- Downstream
- Related
- Published
- 2025-02-26T06:37:05.580Z
- Modified
- 2026-03-10T13:44:54.557128Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ubifs: renamewhiteout: Fix double free for whiteoutui->data
'whiteout_ui->data' will be freed twice if space budget fail for rename whiteout operation as following process:
renamewhiteout dev = kmalloc whiteoutui->data = dev kfree(whiteoutui->data) // Free first time iput(whiteout) ubifsfree_inode kfree(ui->data) // Double free!
KASAN reports:
BUG: KASAN: double-free or invalid-free in ubifsfreeinode+0x4f/0x70 Call Trace: kfree+0x117/0x490 ubifsfreeinode+0x4f/0x70 [ubifs] icallback+0x30/0x60 rcudo_batch+0x366/0xac0 _dosoftirq+0x133/0x57f
Allocated by task 1506: kmemcachealloctrace+0x3c2/0x7a0 dorename+0x9b7/0x1150 [ubifs] ubifsrename+0x106/0x1f0 [ubifs] dosyscall_64+0x35/0x80
Freed by task 1506: kfree+0x117/0x490 dorename.cold+0x53/0x8a [ubifs] ubifsrename+0x106/0x1f0 [ubifs] dosyscall64+0x35/0x80
The buggy address belongs to the object at ffff88810238bed8 which
belongs to the cache kmalloc-8 of size 8
Let ubifsfreeinode() free 'whiteoutui->data'. BTW, delete unused assignment 'whiteoutui->datalen = 0', process 'ubifsevictinode() -> ubifsjnldeleteinode() -> ubifsjnlwriteinode()' doesn't need it (because 'incnlink(whiteout)' won't be excuted by 'goto out_release', and the nlink of whiteout inode is 0).
- References
-
- https://git.kernel.org/stable/c/6d7a158a7363c1f6604aa47ae1a280a5c65123dd
- https://git.kernel.org/stable/c/8b3c7be16f3f4dfd6e15ac651484e59d3fa36274
- https://git.kernel.org/stable/c/a90e2dbe66d2647ff95a0442ad2e86482d977fd8
- https://git.kernel.org/stable/c/b9a937f096e608b3368c1abc920d4d640ba2c94f
- https://git.kernel.org/stable/c/14276d38c89a170363e90b6ac0a53c3cf61b87fc
- https://git.kernel.org/stable/c/2ad07009c459e56ebdcc089d850d664660fdb742
- https://git.kernel.org/stable/c/2b3236ecf96db7af5836e1366ce39ace8ce832fa
- https://git.kernel.org/stable/c/40a8f0d5e7b3999f096570edab71c345da812e3e
Affected packages
Git /
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-47638.json"
unresolved_ranges
[
{
"events": [
{
"introduced": "4.9"
},
{
"fixed": "4.14.276"
}
]
},
{
"events": [
{
"introduced": "4.15"
},
{
"fixed": "4.19.238"
}
]
},
{
"events": [
{
"introduced": "4.20"
},
{
"fixed": "5.4.189"
}
]
},
{
"events": [
{
"introduced": "5.5"
},
{
"fixed": "5.10.110"
}
]
},
{
"events": [
{
"introduced": "5.11"
},
{
"fixed": "5.15.33"
}
]
},
{
"events": [
{
"introduced": "5.16"
},
{
"fixed": "5.16.19"
}
]
},
{
"events": [
{
"introduced": "5.17"
},
{
"fixed": "5.17.2"
}
]
}
]