CVE-2021-47351 (GCVE-0-2021-47351)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2026-08-05 08:47
VLAI
Title
ubifs: Fix races between xattr_{set|get} and listxattr operations
Summary
In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix races between xattr_{set|get} and listxattr operations UBIFS may occur some problems with concurrent xattr_{set|get} and listxattr operations, such as assertion failure, memory corruption, stale xattr value[1]. Fix it by importing a new rw-lock in @ubifs_inode to serilize write operations on xattr, concurrent read operations are still effective, just like ext4. [1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-11 19:01 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08 (git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 38dde03eb239605f428f3f1e4baa73d4933a4cc6 (git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 9558612cb829f2c022b788f55d6b8437d5234a82 (git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < c0756f75c22149d20fcb7d8409827cee905eb386 (git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < f4e3634a3b642225a530c292fdb1e8a4007507f5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.27
Unaffected: 0 , < 2.6.27 (semver)
Unaffected: 5.4.133 , ≤ 5.4.* (semver)
Unaffected: 5.10.51 , ≤ 5.10.* (semver)
Unaffected: 5.12.18 , ≤ 5.12.* (semver)
Unaffected: 5.13.3 , ≤ 5.13.* (semver)
Unaffected: 5.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47351",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T19:01:36.389057Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T19:01:45.807Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.560Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ubifs/super.c",
            "fs/ubifs/ubifs.h",
            "fs/ubifs/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            },
            {
              "lessThan": "38dde03eb239605f428f3f1e4baa73d4933a4cc6",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            },
            {
              "lessThan": "9558612cb829f2c022b788f55d6b8437d5234a82",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            },
            {
              "lessThan": "c0756f75c22149d20fcb7d8409827cee905eb386",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            },
            {
              "lessThan": "f4e3634a3b642225a530c292fdb1e8a4007507f5",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ubifs/super.c",
            "fs/ubifs/ubifs.h",
            "fs/ubifs/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.133",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.133",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.51",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.18",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.3",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix races between xattr_{set|get} and listxattr operations\n\nUBIFS may occur some problems with concurrent xattr_{set|get} and\nlistxattr operations, such as assertion failure, memory corruption,\nstale xattr value[1].\n\nFix it by importing a new rw-lock in @ubifs_inode to serilize write\noperations on xattr, concurrent read operations are still effective,\njust like ext4.\n\n[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via local setxattr/getxattr/listxattr syscalls into UBIFS xattr handlers on a mounted filesystem, not via network packet processing or physical device attachment.\nAC:L - The attacker controls both sides of the race by running concurrent setxattr and listxattr threads against the same inode and can retry indefinitely until the size check is bypassed, so success does not depend on conditions outside attacker influence.\nPR:L - An unprivileged local user who can create or write a regular file on a mounted UBIFS volume can set user.* xattrs and list them; no root or init-namespace capabilities are required.\nUI:N - UBIFS is commonly already mounted as root or data storage on embedded, IoT, and similar devices; the attacker drives setxattr/listxattr from their own processes with no victim mount or open required.\nS:U - Impact is confined to the host kernel heap and UBIFS mount within the same OS security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Racing listxattr against setxattr causes an out-of-bounds write into the kernel kvmalloc list buffer, which is heap memory corruption that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The overflow copies attacker-chosen xattr name bytes past the end of the kernel buffer, yielding a controlled heap write primitive suitable for corruption and privilege escalation.\nA:H - The same race triggers ubifs_assert failures (default remount-ro, optionally panic) and heap corruption that can oops/panic the kernel, denying availability of the system or filesystem."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:23.774Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08"
        },
        {
          "url": "https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5"
        }
      ],
      "title": "ubifs: Fix races between xattr_{set|get} and listxattr operations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47351",
    "datePublished": "2024-05-21T14:35:55.806Z",
    "dateReserved": "2024-05-21T14:28:16.985Z",
    "dateUpdated": "2026-08-05T08:47:23.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47351",
      "date": "2026-08-19",
      "epss": "0.00245",
      "percentile": "0.1604"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nubifs: Fix races between xattr_{set|get} and listxattr operations\\n\\nUBIFS may occur some problems with concurrent xattr_{set|get} and\\nlistxattr operations, such as assertion failure, memory corruption,\\nstale xattr value[1].\\n\\nFix it by importing a new rw-lock in @ubifs_inode to serilize write\\noperations on xattr, concurrent read operations are still effective,\\njust like ext4.\\n\\n[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ubifs: corrige ejecuci\\u00f3ns entre las operaciones xattr_{set|get} y listxattr. UBIFS puede producir algunos problemas con las operaciones xattr_{set|get} y listxattr simult\\u00e1neas, como fallas de aserci\\u00f3n y corrupci\\u00f3n de memoria. , valor xattr obsoleto [1]. Soluc\\u00f3nelo importando un nuevo rw-lock en @ubifs_inode para serializar las operaciones de escritura en xattr, las operaciones de lectura simult\\u00e1neas siguen siendo efectivas, al igual que ext4. [1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com\"}]",
      "id": "CVE-2021-47351",
      "lastModified": "2024-11-21T06:35:56.860",
      "published": "2024-05-21T15:15:21.553",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47351\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:21.553\",\"lastModified\":\"2026-08-04T10:16:59.280\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nubifs: Fix races between xattr_{set|get} and listxattr operations\\n\\nUBIFS may occur some problems with concurrent xattr_{set|get} and\\nlistxattr operations, such as assertion failure, memory corruption,\\nstale xattr value[1].\\n\\nFix it by importing a new rw-lock in @ubifs_inode to serilize write\\noperations on xattr, concurrent read operations are still effective,\\njust like ext4.\\n\\n[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ubifs: corrige ejecuci\u00f3ns entre las operaciones xattr_{set|get} y listxattr. UBIFS puede producir algunos problemas con las operaciones xattr_{set|get} y listxattr simult\u00e1neas, como fallas de aserci\u00f3n y corrupci\u00f3n de memoria. , valor xattr obsoleto [1]. Soluc\u00f3nelo importando un nuevo rw-lock en @ubifs_inode para serializar las operaciones de escritura en xattr, las operaciones de lectura simult\u00e1neas siguen siendo efectivas, al igual que ext4. [1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ubifs/super.c\",\"fs/ubifs/ubifs.h\",\"fs/ubifs/xattr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d\",\"lessThan\":\"7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d\",\"lessThan\":\"38dde03eb239605f428f3f1e4baa73d4933a4cc6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d\",\"lessThan\":\"9558612cb829f2c022b788f55d6b8437d5234a82\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d\",\"lessThan\":\"c0756f75c22149d20fcb7d8409827cee905eb386\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d\",\"lessThan\":\"f4e3634a3b642225a530c292fdb1e8a4007507f5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ubifs/super.c\",\"fs/ubifs/ubifs.h\",\"fs/ubifs/xattr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.27\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.27\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.133\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.51\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.18\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13.3\",\"lessThanOrEqual\":\"5.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-11T19:01:36.389057Z\",\"id\":\"CVE-2021-47351\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-617\"},{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.27\",\"versionEndExcluding\":\"5.4.133\",\"matchCriteriaId\":\"1294CBBF-0C34-4217-91B6-A4A44E42A4DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.51\",\"matchCriteriaId\":\"93289127-DFB3-4515-89DD-50521FF8B7FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.18\",\"matchCriteriaId\":\"79D13C82-E06F-4A70-A3D1-C09494FBC94D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"5.13.3\",\"matchCriteriaId\":\"853187F6-707A-487B-95C0-621B5211B43C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:57:50+00:00",
      "cve": "CVE-2021-47351",
      "id": "CVE-2021-47351",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ubifs: Fix races between xattr_{set|get} and listxattr operations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47351.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:21:34Z",
      "cve": "CVE-2021-47351",
      "id": "CVE-2021-47351",
      "initial_release_date": "2024-05-24T10:33:01Z",
      "product_status:known_not_affected": "288",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47351",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47351.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.560Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47351\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-11T19:01:36.389057Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-11T19:01:42.497Z\"}}], \"cna\": {\"title\": \"ubifs: Fix races between xattr_{set|get} and listxattr operations\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached via local setxattr/getxattr/listxattr syscalls into UBIFS xattr handlers on a mounted filesystem, not via network packet processing or physical device attachment.\\nAC:L - The attacker controls both sides of the race by running concurrent setxattr and listxattr threads against the same inode and can retry indefinitely until the size check is bypassed, so success does not depend on conditions outside attacker influence.\\nPR:L - An unprivileged local user who can create or write a regular file on a mounted UBIFS volume can set user.* xattrs and list them; no root or init-namespace capabilities are required.\\nUI:N - UBIFS is commonly already mounted as root or data storage on embedded, IoT, and similar devices; the attacker drives setxattr/listxattr from their own processes with no victim mount or open required.\\nS:U - Impact is confined to the host kernel heap and UBIFS mount within the same OS security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\\nC:H - Racing listxattr against setxattr causes an out-of-bounds write into the kernel kvmalloc list buffer, which is heap memory corruption that can be leveraged for arbitrary kernel memory disclosure.\\nI:H - The overflow copies attacker-chosen xattr name bytes past the end of the kernel buffer, yielding a controlled heap write primitive suitable for corruption and privilege escalation.\\nA:H - The same race triggers ubifs_assert failures (default remount-ro, optionally panic) and heap corruption that can oops/panic the kernel, denying availability of the system or filesystem.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d\", \"lessThan\": \"7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d\", \"lessThan\": \"38dde03eb239605f428f3f1e4baa73d4933a4cc6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d\", \"lessThan\": \"9558612cb829f2c022b788f55d6b8437d5234a82\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d\", \"lessThan\": \"c0756f75c22149d20fcb7d8409827cee905eb386\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d\", \"lessThan\": \"f4e3634a3b642225a530c292fdb1e8a4007507f5\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ubifs/super.c\", \"fs/ubifs/ubifs.h\", \"fs/ubifs/xattr.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.27\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.27\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.133\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.13.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ubifs/super.c\", \"fs/ubifs/ubifs.h\", \"fs/ubifs/xattr.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08\"}, {\"url\": \"https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6\"}, {\"url\": \"https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82\"}, {\"url\": \"https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386\"}, {\"url\": \"https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nubifs: Fix races between xattr_{set|get} and listxattr operations\\n\\nUBIFS may occur some problems with concurrent xattr_{set|get} and\\nlistxattr operations, such as assertion failure, memory corruption,\\nstale xattr value[1].\\n\\nFix it by importing a new rw-lock in @ubifs_inode to serilize write\\noperations on xattr, concurrent read operations are still effective,\\njust like ext4.\\n\\n[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.133\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.51\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.18\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13.3\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14\", \"versionStartIncluding\": \"2.6.27\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:47:23.774Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47351\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:47:23.774Z\", \"dateReserved\": \"2024-05-21T14:28:16.985Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:35:55.806Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.