CVE-2021-47113 (GCVE-0-2021-47113)

Vulnerability from cvelistv5 – Published: 2024-03-15 20:14 – Updated: 2026-08-05 08:46
VLAI
Title
btrfs: abort in rename_exchange if we fail to insert the second ref
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: abort in rename_exchange if we fail to insert the second ref Error injection stress uncovered a problem where we'd leave a dangling inode ref if we failed during a rename_exchange. This happens because we insert the inode ref for one side of the rename, and then for the other side. If this second inode ref insert fails we'll leave the first one dangling and leave a corrupt file system behind. Fix this by aborting if we did the insert for the first inode ref.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: cdd1fedf8261cd7a73c0596298902ff4f0f04492 , < 0df50d47d17401f9f140dfbe752a65e5d72f9932 (git)
Affected: cdd1fedf8261cd7a73c0596298902ff4f0f04492 , < ff8de2cec65a8c8521faade12a31b39c80e49f5b (git)
Affected: cdd1fedf8261cd7a73c0596298902ff4f0f04492 , < dc09ef3562726cd520c8338c1640872a60187af5 (git)
Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 5.10.43 , ≤ 5.10.* (semver)
Unaffected: 5.12.10 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T15:16:26.695834Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:51.773Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.855Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0df50d47d17401f9f140dfbe752a65e5d72f9932",
              "status": "affected",
              "version": "cdd1fedf8261cd7a73c0596298902ff4f0f04492",
              "versionType": "git"
            },
            {
              "lessThan": "ff8de2cec65a8c8521faade12a31b39c80e49f5b",
              "status": "affected",
              "version": "cdd1fedf8261cd7a73c0596298902ff4f0f04492",
              "versionType": "git"
            },
            {
              "lessThan": "dc09ef3562726cd520c8338c1640872a60187af5",
              "status": "affected",
              "version": "cdd1fedf8261cd7a73c0596298902ff4f0f04492",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.43",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.10",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort in rename_exchange if we fail to insert the second ref\n\nError injection stress uncovered a problem where we\u0027d leave a dangling\ninode ref if we failed during a rename_exchange.  This happens because\nwe insert the inode ref for one side of the rename, and then for the\nother side.  If this second inode ref insert fails we\u0027ll leave the first\none dangling and leave a corrupt file system behind.  Fix this by\naborting if we did the insert for the first inode ref."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only in btrfs_rename_exchange, reached via local renameat2(RENAME_EXCHANGE) \u2192 vfs_rename \u2192 btrfs_rename2. nfsd and ksmbd call vfs_rename without RENAME_EXCHANGE, so there is no network protocol path into this function.\nAC:L - An attacker who can call rename_exchange on two entries they control can induce second-insert failure via memory or metadata pressure (ENOMEM/ENOSPC/EIO paths in btrfs_insert_inode_ref), matching how analogous unaborted-transaction bugs were scored; under uncertainty AC:L is required.\nPR:L - vfs_rename only requires ordinary directory write/exec (may_delete/may_create) on an already-mounted btrfs volume; an unprivileged user with a writable directory does not need init-namespace root or capabilities.\nUI:N - No separate victim action is required once btrfs is mounted (common for home/container/NAS volumes); the attacker triggers the bug solely through their own renameat2(RENAME_EXCHANGE) calls.\nS:U - Impact is durable corruption of the host btrfs instance within the same kernel/OS security authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:N - The defect commits a dangling inode_ref (on-disk metadata inconsistency) and provides no OOB/UAF read or other kernel or cross-user information-disclosure primitive.\nI:H - Without aborting after the first successful inode_ref insert, btrfs_end_transaction can allow that partial change to commit, leaving durable filesystem corruption (dangling inode refs), which is high integrity impact on FS metadata.\nA:H - Committed inode-ref corruption can break later unlink/lookup/balance/scrub paths and destabilize the shared volume for all users, constituting high availability impact comparable to other unaborted btrfs transaction bugs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:06.772Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5"
        }
      ],
      "title": "btrfs: abort in rename_exchange if we fail to insert the second ref",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47113",
    "datePublished": "2024-03-15T20:14:21.300Z",
    "dateReserved": "2024-03-04T18:12:48.836Z",
    "dateUpdated": "2026-08-05T08:46:06.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47113",
      "date": "2026-08-09",
      "epss": "0.00269",
      "percentile": "0.18807"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: abort in rename_exchange if we fail to insert the second ref\\n\\nError injection stress uncovered a problem where we\u0027d leave a dangling\\ninode ref if we failed during a rename_exchange.  This happens because\\nwe insert the inode ref for one side of the rename, and then for the\\nother side.  If this second inode ref insert fails we\u0027ll leave the first\\none dangling and leave a corrupt file system behind.  Fix this by\\naborting if we did the insert for the first inode ref.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: btrfs: abortar en rename_exchange si no logramos insertar la segunda referencia. El error de inyecci\\u00f3n de estr\\u00e9s descubri\\u00f3 un problema en el que dejar\\u00edamos una referencia de inodo colgante si fall\\u00e1bamos durante un rename_exchange. Esto sucede porque insertamos la referencia del inodo para un lado del cambio de nombre y luego para el otro lado. Si esta segunda inserci\\u00f3n de referencia de inodo falla, dejaremos el primero colgando y dejaremos un sistema de archivos corrupto. Solucione este problema abortando si hicimos la inserci\\u00f3n para la primera referencia de inodo.\"}]",
      "id": "CVE-2021-47113",
      "lastModified": "2024-11-21T06:35:25.433",
      "published": "2024-03-15T21:15:06.673",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47113\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-15T21:15:06.673\",\"lastModified\":\"2026-08-04T10:16:46.740\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: abort in rename_exchange if we fail to insert the second ref\\n\\nError injection stress uncovered a problem where we\u0027d leave a dangling\\ninode ref if we failed during a rename_exchange.  This happens because\\nwe insert the inode ref for one side of the rename, and then for the\\nother side.  If this second inode ref insert fails we\u0027ll leave the first\\none dangling and leave a corrupt file system behind.  Fix this by\\naborting if we did the insert for the first inode ref.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: btrfs: abortar en rename_exchange si no logramos insertar la segunda referencia. El error de inyecci\u00f3n de estr\u00e9s descubri\u00f3 un problema en el que dejar\u00edamos una referencia de inodo colgante si fall\u00e1bamos durante un rename_exchange. Esto sucede porque insertamos la referencia del inodo para un lado del cambio de nombre y luego para el otro lado. Si esta segunda inserci\u00f3n de referencia de inodo falla, dejaremos el primero colgando y dejaremos un sistema de archivos corrupto. Solucione este problema abortando si hicimos la inserci\u00f3n para la primera referencia de inodo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cdd1fedf8261cd7a73c0596298902ff4f0f04492\",\"lessThan\":\"0df50d47d17401f9f140dfbe752a65e5d72f9932\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdd1fedf8261cd7a73c0596298902ff4f0f04492\",\"lessThan\":\"ff8de2cec65a8c8521faade12a31b39c80e49f5b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdd1fedf8261cd7a73c0596298902ff4f0f04492\",\"lessThan\":\"dc09ef3562726cd520c8338c1640872a60187af5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.43\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.10\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-03-18T15:16:26.695834Z\",\"id\":\"CVE-2021-47113\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.43\",\"matchCriteriaId\":\"EED29F26-07A5-4096-A687-701C4F98A541\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.10\",\"matchCriteriaId\":\"27384800-AB48-4C08-891E-34B66F5FC4AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA610E30-717C-4700-9F77-A3C9244F3BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1ECD33F5-85BE-430B-8F86-8D7BD560311D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:04:38+00:00",
      "cve": "CVE-2021-47113",
      "id": "CVE-2021-47113",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: abort in rename_exchange if we fail to insert the second ref",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47113.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T02:08:15Z",
      "cve": "CVE-2021-47113",
      "id": "CVE-2021-47113",
      "initial_release_date": "2024-03-19T03:50:26Z",
      "product_status:known_affected": "455",
      "product_status:known_not_affected": "210",
      "product_status:recommended": "205",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47113",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47113.json",
      "version": "49"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.855Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47113\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-18T15:16:26.695834Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:18.327Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"btrfs: abort in rename_exchange if we fail to insert the second ref\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is only in btrfs_rename_exchange, reached via local renameat2(RENAME_EXCHANGE) \\u2192 vfs_rename \\u2192 btrfs_rename2. nfsd and ksmbd call vfs_rename without RENAME_EXCHANGE, so there is no network protocol path into this function.\\nAC:L - An attacker who can call rename_exchange on two entries they control can induce second-insert failure via memory or metadata pressure (ENOMEM/ENOSPC/EIO paths in btrfs_insert_inode_ref), matching how analogous unaborted-transaction bugs were scored; under uncertainty AC:L is required.\\nPR:L - vfs_rename only requires ordinary directory write/exec (may_delete/may_create) on an already-mounted btrfs volume; an unprivileged user with a writable directory does not need init-namespace root or capabilities.\\nUI:N - No separate victim action is required once btrfs is mounted (common for home/container/NAS volumes); the attacker triggers the bug solely through their own renameat2(RENAME_EXCHANGE) calls.\\nS:U - Impact is durable corruption of the host btrfs instance within the same kernel/OS security authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\\nC:N - The defect commits a dangling inode_ref (on-disk metadata inconsistency) and provides no OOB/UAF read or other kernel or cross-user information-disclosure primitive.\\nI:H - Without aborting after the first successful inode_ref insert, btrfs_end_transaction can allow that partial change to commit, leaving durable filesystem corruption (dangling inode refs), which is high integrity impact on FS metadata.\\nA:H - Committed inode-ref corruption can break later unlink/lookup/balance/scrub paths and destabilize the shared volume for all users, constituting high availability impact comparable to other unaborted btrfs transaction bugs.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"cdd1fedf8261cd7a73c0596298902ff4f0f04492\", \"lessThan\": \"0df50d47d17401f9f140dfbe752a65e5d72f9932\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cdd1fedf8261cd7a73c0596298902ff4f0f04492\", \"lessThan\": \"ff8de2cec65a8c8521faade12a31b39c80e49f5b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cdd1fedf8261cd7a73c0596298902ff4f0f04492\", \"lessThan\": \"dc09ef3562726cd520c8338c1640872a60187af5\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/inode.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.43\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/inode.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932\"}, {\"url\": \"https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b\"}, {\"url\": \"https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: abort in rename_exchange if we fail to insert the second ref\\n\\nError injection stress uncovered a problem where we\u0027d leave a dangling\\ninode ref if we failed during a rename_exchange.  This happens because\\nwe insert the inode ref for one side of the rename, and then for the\\nother side.  If this second inode ref insert fails we\u0027ll leave the first\\none dangling and leave a corrupt file system behind.  Fix this by\\naborting if we did the insert for the first inode ref.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.43\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.10\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"4.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:06.772Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47113\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:06.772Z\", \"dateReserved\": \"2024-03-04T18:12:48.836Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-15T20:14:21.300Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.