CVE-2021-47189
Vulnerability from cvelistv5
Published
2024-04-10 18:56
Modified
2024-11-04 12:01
Severity ?
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Summary
btrfs: fix memory ordering between normal and ordered work functions
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/45da9c1767ac31857df572f0a909fbe88fd5a7e9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/47e6f9f69153247109042010f3a77579e9dc61ff
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/637d652d351fd4f263ef302dc52f3971d314e500
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/670f6b3867c8f0f11e5097f353b164cecfec6179
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6adbc07ebcaf8bead08b21687d49e0fc94400987
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/804a9d239ae9cbe88e861a7cd62319cc6ec7b136
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bd660a20fea3ec60a49709ef5360f145ec0fe779
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ed058d735a70f4b063323f1a7bb33cda0f987513
Impacted products
Vendor Product Version
Linux Linux Version: 3.15
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47189",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T19:44:25.164224Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-01T17:56:06.717Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.308Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bd660a20fea3ec60a49709ef5360f145ec0fe779"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/637d652d351fd4f263ef302dc52f3971d314e500"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/804a9d239ae9cbe88e861a7cd62319cc6ec7b136"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed058d735a70f4b063323f1a7bb33cda0f987513"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/670f6b3867c8f0f11e5097f353b164cecfec6179"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6adbc07ebcaf8bead08b21687d49e0fc94400987"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/47e6f9f69153247109042010f3a77579e9dc61ff"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/45da9c1767ac31857df572f0a909fbe88fd5a7e9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/async-thread.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bd660a20fea3",
              "status": "affected",
              "version": "08a9ff326418",
              "versionType": "git"
            },
            {
              "lessThan": "637d652d351f",
              "status": "affected",
              "version": "08a9ff326418",
              "versionType": "git"
            },
            {
              "lessThan": "804a9d239ae9",
              "status": "affected",
              "version": "08a9ff326418",
              "versionType": "git"
            },
            {
              "lessThan": "ed058d735a70",
              "status": "affected",
              "version": "08a9ff326418",
              "versionType": "git"
            },
            {
              "lessThan": "670f6b3867c8",
              "status": "affected",
              "version": "08a9ff326418",
              "versionType": "git"
            },
            {
              "lessThan": "6adbc07ebcaf",
              "status": "affected",
              "version": "08a9ff326418",
              "versionType": "git"
            },
            {
              "lessThan": "47e6f9f69153",
              "status": "affected",
              "version": "08a9ff326418",
              "versionType": "git"
            },
            {
              "lessThan": "45da9c1767ac",
              "status": "affected",
              "version": "08a9ff326418",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/async-thread.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory ordering between normal and ordered work functions\n\nOrdered work functions aren\u0027t guaranteed to be handled by the same thread\nwhich executed the normal work functions. The only way execution between\nnormal/ordered functions is synchronized is via the WORK_DONE_BIT,\nunfortunately the used bitops don\u0027t guarantee any ordering whatsoever.\n\nThis manifested as seemingly inexplicable crashes on ARM64, where\nasync_chunk::inode is seen as non-null in async_cow_submit which causes\nsubmit_compressed_extents to be called and crash occurs because\nasync_chunk::inode suddenly became NULL. The call trace was similar to:\n\n    pc : submit_compressed_extents+0x38/0x3d0\n    lr : async_cow_submit+0x50/0xd0\n    sp : ffff800015d4bc20\n\n    \u003cregisters omitted for brevity\u003e\n\n    Call trace:\n     submit_compressed_extents+0x38/0x3d0\n     async_cow_submit+0x50/0xd0\n     run_ordered_work+0xc8/0x280\n     btrfs_work_helper+0x98/0x250\n     process_one_work+0x1f0/0x4ac\n     worker_thread+0x188/0x504\n     kthread+0x110/0x114\n     ret_from_fork+0x10/0x18\n\nFix this by adding respective barrier calls which ensure that all\naccesses preceding setting of WORK_DONE_BIT are strictly ordered before\nsetting the flag. At the same time add a read barrier after reading of\nWORK_DONE_BIT in run_ordered_work which ensures all subsequent loads\nwould be strictly ordered after reading the bit. This in turn ensures\nare all accesses before WORK_DONE_BIT are going to be strictly ordered\nbefore any access that can occur in ordered_func."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T12:01:11.187Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bd660a20fea3ec60a49709ef5360f145ec0fe779"
        },
        {
          "url": "https://git.kernel.org/stable/c/637d652d351fd4f263ef302dc52f3971d314e500"
        },
        {
          "url": "https://git.kernel.org/stable/c/804a9d239ae9cbe88e861a7cd62319cc6ec7b136"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed058d735a70f4b063323f1a7bb33cda0f987513"
        },
        {
          "url": "https://git.kernel.org/stable/c/670f6b3867c8f0f11e5097f353b164cecfec6179"
        },
        {
          "url": "https://git.kernel.org/stable/c/6adbc07ebcaf8bead08b21687d49e0fc94400987"
        },
        {
          "url": "https://git.kernel.org/stable/c/47e6f9f69153247109042010f3a77579e9dc61ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/45da9c1767ac31857df572f0a909fbe88fd5a7e9"
        }
      ],
      "title": "btrfs: fix memory ordering between normal and ordered work functions",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47189",
    "datePublished": "2024-04-10T18:56:28.194Z",
    "dateReserved": "2024-03-25T09:12:14.113Z",
    "dateUpdated": "2024-11-04T12:01:11.187Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47189\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-10T19:15:47.570\",\"lastModified\":\"2024-11-01T18:35:00.807\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix memory ordering between normal and ordered work functions\\n\\nOrdered work functions aren\u0027t guaranteed to be handled by the same thread\\nwhich executed the normal work functions. The only way execution between\\nnormal/ordered functions is synchronized is via the WORK_DONE_BIT,\\nunfortunately the used bitops don\u0027t guarantee any ordering whatsoever.\\n\\nThis manifested as seemingly inexplicable crashes on ARM64, where\\nasync_chunk::inode is seen as non-null in async_cow_submit which causes\\nsubmit_compressed_extents to be called and crash occurs because\\nasync_chunk::inode suddenly became NULL. The call trace was similar to:\\n\\n    pc : submit_compressed_extents+0x38/0x3d0\\n    lr : async_cow_submit+0x50/0xd0\\n    sp : ffff800015d4bc20\\n\\n    \u003cregisters omitted for brevity\u003e\\n\\n    Call trace:\\n     submit_compressed_extents+0x38/0x3d0\\n     async_cow_submit+0x50/0xd0\\n     run_ordered_work+0xc8/0x280\\n     btrfs_work_helper+0x98/0x250\\n     process_one_work+0x1f0/0x4ac\\n     worker_thread+0x188/0x504\\n     kthread+0x110/0x114\\n     ret_from_fork+0x10/0x18\\n\\nFix this by adding respective barrier calls which ensure that all\\naccesses preceding setting of WORK_DONE_BIT are strictly ordered before\\nsetting the flag. At the same time add a read barrier after reading of\\nWORK_DONE_BIT in run_ordered_work which ensures all subsequent loads\\nwould be strictly ordered after reading the bit. This in turn ensures\\nare all accesses before WORK_DONE_BIT are going to be strictly ordered\\nbefore any access that can occur in ordered_func.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: arreglo del ordenamiento de memoria entre funciones de trabajo normales y ordenadas No se garantiza que las funciones de trabajo ordenadas sean manejadas por el mismo hilo que ejecut\u00f3 las funciones de trabajo normales. La \u00fanica forma de sincronizar la ejecuci\u00f3n entre funciones normales/ordenadas es a trav\u00e9s de WORK_DONE_BIT, desafortunadamente los bitops utilizados no garantizan ning\u00fan orden. Esto se manifest\u00f3 como fallas aparentemente inexplicables en ARM64, donde async_chunk::inode se ve como no nulo en async_cow_submit, lo que hace que se llame a submission_compressed_extents y se produce una falla porque async_chunk::inode de repente se volvi\u00f3 NULL. El seguimiento de llamadas fue similar a: pc : submission_compressed_extents+0x38/0x3d0 lr : async_cow_submit+0x50/0xd0 sp : ffff800015d4bc20  Seguimiento de llamadas: submission_compressed_extents+0x38/0x3d0 async_cow_submit+0x50/0xd0 run_ordered_work+0xc8/0x280 btrfs_work_helper+0x98/0x250 process_one_work+0x1f0/0x4ac worker_thread+0x188/0x504 kthread+0x110/0x114 ret_from_fork+0x10/0x18 Solucione esto agregando las llamadas de barrera respectivas que garantizan que todos los accesos anteriores a la configuraci\u00f3n de Los bits WORK_DONE_BIT se ordenan estrictamente antes de establecer la bandera. Al mismo tiempo, agregue una barrera de lectura despu\u00e9s de la lectura de WORK_DONE_BIT en run_ordered_work que garantiza que todas las cargas posteriores se ordenar\u00e1n estrictamente despu\u00e9s de leer el bit. Esto, a su vez, garantiza que todos los accesos antes de WORK_DONE_BIT se ordenar\u00e1n estrictamente antes de cualquier acceso que pueda ocurrir en ordered_func.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.4}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/45da9c1767ac31857df572f0a909fbe88fd5a7e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47e6f9f69153247109042010f3a77579e9dc61ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/637d652d351fd4f263ef302dc52f3971d314e500\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/670f6b3867c8f0f11e5097f353b164cecfec6179\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6adbc07ebcaf8bead08b21687d49e0fc94400987\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/804a9d239ae9cbe88e861a7cd62319cc6ec7b136\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bd660a20fea3ec60a49709ef5360f145ec0fe779\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed058d735a70f4b063323f1a7bb33cda0f987513\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.