CVE-2021-47638
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-47638
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-47638.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-47638
- Related
- Published
- 2025-02-26T06:37:05Z
- Modified
- 2025-02-26T19:02:41.514580Z
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ubifs: renamewhiteout: Fix double free for whiteoutui->data
'whiteout_ui->data' will be freed twice if space budget fail for rename whiteout operation as following process:
renamewhiteout dev = kmalloc whiteoutui->data = dev kfree(whiteoutui->data) // Free first time iput(whiteout) ubifsfree_inode kfree(ui->data) // Double free!
KASAN reports:
BUG: KASAN: double-free or invalid-free in ubifsfreeinode+0x4f/0x70 Call Trace: kfree+0x117/0x490 ubifsfreeinode+0x4f/0x70 [ubifs] icallback+0x30/0x60 rcudobatch+0x366/0xac0 _do_softirq+0x133/0x57f
Allocated by task 1506: kmemcachealloctrace+0x3c2/0x7a0 dorename+0x9b7/0x1150 [ubifs] ubifsrename+0x106/0x1f0 [ubifs] dosyscall_64+0x35/0x80
Freed by task 1506: kfree+0x117/0x490 dorename.cold+0x53/0x8a [ubifs] ubifsrename+0x106/0x1f0 [ubifs] dosyscall64+0x35/0x80
The buggy address belongs to the object at ffff88810238bed8 which
belongs to the cache kmalloc-8 of size 8
Let ubifsfreeinode() free 'whiteoutui->data'. BTW, delete unused assignment 'whiteoutui->datalen = 0', process 'ubifsevictinode() -> ubifsjnldeleteinode() -> ubifsjnlwriteinode()' doesn't need it (because 'incnlink(whiteout)' won't be excuted by 'goto out_release', and the nlink of whiteout inode is 0).
- References
-
- https://git.kernel.org/stable/c/14276d38c89a170363e90b6ac0a53c3cf61b87fc
- https://git.kernel.org/stable/c/2ad07009c459e56ebdcc089d850d664660fdb742
- https://git.kernel.org/stable/c/2b3236ecf96db7af5836e1366ce39ace8ce832fa
- https://git.kernel.org/stable/c/40a8f0d5e7b3999f096570edab71c345da812e3e
- https://git.kernel.org/stable/c/6d7a158a7363c1f6604aa47ae1a280a5c65123dd
- https://git.kernel.org/stable/c/8b3c7be16f3f4dfd6e15ac651484e59d3fa36274
- https://git.kernel.org/stable/c/a90e2dbe66d2647ff95a0442ad2e86482d977fd8
- https://git.kernel.org/stable/c/b9a937f096e608b3368c1abc920d4d640ba2c94f
- https://security-tracker.debian.org/tracker/CVE-2021-47638
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.113-1
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source