CVE-2021-47254 (GCVE-0-2021-47254)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:19 – Updated: 2026-08-05 08:46
VLAI
Title
gfs2: Fix use-after-free in gfs2_glock_shrink_scan
Summary
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in gfs2_glock_shrink_scan The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to remove the glock from the lru list in __gfs2_glock_put(). On the shrink scan path, the same flag is cleared under lru_lock but because of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the put side can be made without deleting the glock from the lru list. Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to ensure correct behavior on both sides - clear GLF_LRU after list_del under lru_lock.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-17 17:37 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6948c6bc17d666663a84c124b3176039e64a58f4 , < 38ce329534500bf4ae71f81df6a37a406cf187b4 (git)
Affected: b568ed385a18c0ddbe41862b69088b636550a04f , < 92869945cc5b78ee8a1ef90336fe070893e3458a (git)
Affected: 762bb3528249604bc680a9df635e8995740176de , < 0364742decb0f02bc183404868b82896f7992595 (git)
Affected: bac8520892812dada1ac93f27d96317470d24b1f , < 094bf5670e762afa243d2c41a5c4ab71c7447bf4 (git)
Affected: 7881ef3f33bb80f459ea6020d1e021fc524a6348 , < 86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d (git)
Affected: 7881ef3f33bb80f459ea6020d1e021fc524a6348 , < a61156314b66456ab6a291ed5deba1ebd002ab3c (git)
Affected: 7881ef3f33bb80f459ea6020d1e021fc524a6348 , < e87ef30fe73e7e10d2c85bdcc778dcec24dca553 (git)
Affected: 7881ef3f33bb80f459ea6020d1e021fc524a6348 , < 1ab19c5de4c537ec0d9b21020395a5b5a6c059b2 (git)
Affected: 1e7a416fb765c9072479dc424780c0937ba99270 (git)
Affected: dcbdbe13796ffa561510d2686a6318564e728bbd (git)
Affected: 4.4.181 , < 4.4.274 (semver)
Affected: 4.9.180 , < 4.9.274 (semver)
Affected: 4.14.123 , < 4.14.238 (semver)
Affected: 4.19.47 , < 4.19.196 (semver)
Affected: 5.0.20 , < 5.1 (semver)
Affected: 5.1.6 , < 5.2 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 4.4.274 , ≤ 4.4.* (semver)
Unaffected: 4.9.274 , ≤ 4.9.* (semver)
Unaffected: 4.14.238 , ≤ 4.14.* (semver)
Unaffected: 4.19.196 , ≤ 4.19.* (semver)
Unaffected: 5.4.127 , ≤ 5.4.* (semver)
Unaffected: 5.10.45 , ≤ 5.10.* (semver)
Unaffected: 5.12.12 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47254",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:37:55.520472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:39:42.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.867Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/glock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "38ce329534500bf4ae71f81df6a37a406cf187b4",
              "status": "affected",
              "version": "6948c6bc17d666663a84c124b3176039e64a58f4",
              "versionType": "git"
            },
            {
              "lessThan": "92869945cc5b78ee8a1ef90336fe070893e3458a",
              "status": "affected",
              "version": "b568ed385a18c0ddbe41862b69088b636550a04f",
              "versionType": "git"
            },
            {
              "lessThan": "0364742decb0f02bc183404868b82896f7992595",
              "status": "affected",
              "version": "762bb3528249604bc680a9df635e8995740176de",
              "versionType": "git"
            },
            {
              "lessThan": "094bf5670e762afa243d2c41a5c4ab71c7447bf4",
              "status": "affected",
              "version": "bac8520892812dada1ac93f27d96317470d24b1f",
              "versionType": "git"
            },
            {
              "lessThan": "86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d",
              "status": "affected",
              "version": "7881ef3f33bb80f459ea6020d1e021fc524a6348",
              "versionType": "git"
            },
            {
              "lessThan": "a61156314b66456ab6a291ed5deba1ebd002ab3c",
              "status": "affected",
              "version": "7881ef3f33bb80f459ea6020d1e021fc524a6348",
              "versionType": "git"
            },
            {
              "lessThan": "e87ef30fe73e7e10d2c85bdcc778dcec24dca553",
              "status": "affected",
              "version": "7881ef3f33bb80f459ea6020d1e021fc524a6348",
              "versionType": "git"
            },
            {
              "lessThan": "1ab19c5de4c537ec0d9b21020395a5b5a6c059b2",
              "status": "affected",
              "version": "7881ef3f33bb80f459ea6020d1e021fc524a6348",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1e7a416fb765c9072479dc424780c0937ba99270",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dcbdbe13796ffa561510d2686a6318564e728bbd",
              "versionType": "git"
            },
            {
              "lessThan": "4.4.274",
              "status": "affected",
              "version": "4.4.181",
              "versionType": "semver"
            },
            {
              "lessThan": "4.9.274",
              "status": "affected",
              "version": "4.9.180",
              "versionType": "semver"
            },
            {
              "lessThan": "4.14.238",
              "status": "affected",
              "version": "4.14.123",
              "versionType": "semver"
            },
            {
              "lessThan": "4.19.196",
              "status": "affected",
              "version": "4.19.47",
              "versionType": "semver"
            },
            {
              "lessThan": "5.1",
              "status": "affected",
              "version": "5.0.20",
              "versionType": "semver"
            },
            {
              "lessThan": "5.2",
              "status": "affected",
              "version": "5.1.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/glock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.274",
                  "versionStartIncluding": "4.4.181",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.274",
                  "versionStartIncluding": "4.9.180",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.238",
                  "versionStartIncluding": "4.14.123",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.196",
                  "versionStartIncluding": "4.19.47",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.127",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.45",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.12",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.0.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.1.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in gfs2_glock_shrink_scan\n\nThe GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to\nremove the glock from the lru list in __gfs2_glock_put().\n\nOn the shrink scan path, the same flag is cleared under lru_lock but because\nof cond_resched_lock(\u0026lru_lock) in gfs2_dispose_glock_lru(), progress on the\nput side can be made without deleting the glock from the lru list.\n\nKeep GLF_LRU across the race window opened by cond_resched_lock(\u0026lru_lock) to\nensure correct behavior on both sides - clear GLF_LRU after list_del under\nlru_lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is the local GFS2 glock LRU shrinker and glock put path, reached via local filesystem operations and memory reclaim on a mounted GFS2 volume, not via network packet processing.\nAC:L - An attacker can induce both sides of the race by churning inode/iopen/flock glocks onto the LRU through ordinary file operations while concurrently creating memory pressure to force gfs2_glock_shrink_scan and dispose.\nPR:L - On a multi-user GFS2 deployment the filesystem is already mounted; an unprivileged local user with access to that mount can trigger glock get/put and reclaim without CAP_SYS_ADMIN.\nUI:N - No separate victim action is required; the attacker triggers the race through their own filesystem activity and memory allocation once GFS2 is available.\nS:U - This is a standard in-kernel use-after-free enabling privilege escalation within the same host security authority, not a VM/IOMMU/sandbox boundary crossing.\nC:H - Use-after-free of a slab-allocated gfs2_glock (aspace) object allows reclaim of attacker-controlled contents and arbitrary kernel memory disclosure primitives.\nI:H - The same UAF enables heap spraying and corruption of the freed glock object, providing arbitrary write / control-flow hijacking potential in the kernel.\nA:H - The bug manifests as a kernel use-after-free during list_del in gfs2_dispose_glock_lru (observed under KASAN), which can oops/panic and deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:59.624Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595"
        },
        {
          "url": "https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2"
        }
      ],
      "title": "gfs2: Fix use-after-free in gfs2_glock_shrink_scan",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47254",
    "datePublished": "2024-05-21T14:19:49.475Z",
    "dateReserved": "2024-04-10T18:59:19.539Z",
    "dateUpdated": "2026-08-05T08:46:59.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47254",
      "date": "2026-09-15",
      "epss": "0.00241",
      "percentile": "0.15354"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.4.274\", \"matchCriteriaId\": \"D3914458-19C3-4C3A-BDE5-1709DBA9D80E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.5\", \"versionEndExcluding\": \"4.9.274\", \"matchCriteriaId\": \"0A84D5BC-006F-41C5-A54D-6D45236009B3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.10\", \"versionEndExcluding\": \"4.14.238\", \"matchCriteriaId\": \"C3C0DBBF-0923-4D2A-9178-134691F9933F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.15\", \"versionEndExcluding\": \"4.19.196\", \"matchCriteriaId\": \"F3CAB837-7D38-4934-AD4F-195CEFD754E6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.127\", \"matchCriteriaId\": \"F4B9330C-95B8-4F1B-925D-09F7CC307E25\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.45\", \"matchCriteriaId\": \"0CF0334B-62CB-4FBC-8B76-57CC31EBDE56\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.12.12\", \"matchCriteriaId\": \"958321CA-952B-461A-A590-F4096CB20E02\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"DA610E30-717C-4700-9F77-A3C9244F3BFD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"1ECD33F5-85BE-430B-8F86-8D7BD560311D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngfs2: Fix use-after-free in gfs2_glock_shrink_scan\\n\\nThe GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to\\nremove the glock from the lru list in __gfs2_glock_put().\\n\\nOn the shrink scan path, the same flag is cleared under lru_lock but because\\nof cond_resched_lock(\u0026lru_lock) in gfs2_dispose_glock_lru(), progress on the\\nput side can be made without deleting the glock from the lru list.\\n\\nKeep GLF_LRU across the race window opened by cond_resched_lock(\u0026lru_lock) to\\nensure correct behavior on both sides - clear GLF_LRU after list_del under\\nlru_lock.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gfs2: corrige use-after-free en gfs2_glock_shrink_scan. El indicador GLF_LRU se marca en lru_lock en gfs2_glock_remove_from_lru() para eliminar el glock de la lista lru en __gfs2_glock_put(). En la ruta de escaneo de reducci\\u00f3n, la misma bandera se borra en lru_lock pero debido a cond_resched_lock(\u0026amp;lru_lock) en gfs2_dispose_glock_lru(), se puede avanzar en el lado de venta sin eliminar la glock de la lista de lru. Mantenga GLF_LRU en la ventana de ejecuci\\u00f3n abierta por cond_resched_lock(\u0026amp;lru_lock) para garantizar un comportamiento correcto en ambos lados; borre GLF_LRU despu\\u00e9s de list_del en lru_lock.\"}]",
      "id": "CVE-2021-47254",
      "lastModified": "2024-12-30T19:50:58.543",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-05-21T15:15:14.233",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47254\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:14.233\",\"lastModified\":\"2026-08-04T10:16:55.263\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngfs2: Fix use-after-free in gfs2_glock_shrink_scan\\n\\nThe GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to\\nremove the glock from the lru list in __gfs2_glock_put().\\n\\nOn the shrink scan path, the same flag is cleared under lru_lock but because\\nof cond_resched_lock(\u0026lru_lock) in gfs2_dispose_glock_lru(), progress on the\\nput side can be made without deleting the glock from the lru list.\\n\\nKeep GLF_LRU across the race window opened by cond_resched_lock(\u0026lru_lock) to\\nensure correct behavior on both sides - clear GLF_LRU after list_del under\\nlru_lock.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gfs2: corrige use-after-free en gfs2_glock_shrink_scan. El indicador GLF_LRU se marca en lru_lock en gfs2_glock_remove_from_lru() para eliminar el glock de la lista lru en __gfs2_glock_put(). En la ruta de escaneo de reducci\u00f3n, la misma bandera se borra en lru_lock pero debido a cond_resched_lock(\u0026amp;lru_lock) en gfs2_dispose_glock_lru(), se puede avanzar en el lado de venta sin eliminar la glock de la lista de lru. Mantenga GLF_LRU en la ventana de ejecuci\u00f3n abierta por cond_resched_lock(\u0026amp;lru_lock) para garantizar un comportamiento correcto en ambos lados; borre GLF_LRU despu\u00e9s de list_del en lru_lock.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/gfs2/glock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6948c6bc17d666663a84c124b3176039e64a58f4\",\"lessThan\":\"38ce329534500bf4ae71f81df6a37a406cf187b4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b568ed385a18c0ddbe41862b69088b636550a04f\",\"lessThan\":\"92869945cc5b78ee8a1ef90336fe070893e3458a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"762bb3528249604bc680a9df635e8995740176de\",\"lessThan\":\"0364742decb0f02bc183404868b82896f7992595\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bac8520892812dada1ac93f27d96317470d24b1f\",\"lessThan\":\"094bf5670e762afa243d2c41a5c4ab71c7447bf4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7881ef3f33bb80f459ea6020d1e021fc524a6348\",\"lessThan\":\"86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7881ef3f33bb80f459ea6020d1e021fc524a6348\",\"lessThan\":\"a61156314b66456ab6a291ed5deba1ebd002ab3c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7881ef3f33bb80f459ea6020d1e021fc524a6348\",\"lessThan\":\"e87ef30fe73e7e10d2c85bdcc778dcec24dca553\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7881ef3f33bb80f459ea6020d1e021fc524a6348\",\"lessThan\":\"1ab19c5de4c537ec0d9b21020395a5b5a6c059b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e7a416fb765c9072479dc424780c0937ba99270\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dcbdbe13796ffa561510d2686a6318564e728bbd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.4.181\",\"lessThan\":\"4.4.274\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.180\",\"lessThan\":\"4.9.274\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.123\",\"lessThan\":\"4.14.238\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.47\",\"lessThan\":\"4.19.196\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.0.20\",\"lessThan\":\"5.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.1.6\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/gfs2/glock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.4.274\",\"lessThanOrEqual\":\"4.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.274\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.238\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.196\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.127\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.45\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.12\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-17T17:37:55.520472Z\",\"id\":\"CVE-2021-47254\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.181\",\"versionEndExcluding\":\"4.4.274\",\"matchCriteriaId\":\"44E91470-9095-4293-A0AA-D5E7AE19B091\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.180\",\"versionEndExcluding\":\"4.9.274\",\"matchCriteriaId\":\"06235B73-91A9-474C-9720-FFC643A527EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.123\",\"versionEndExcluding\":\"4.14.238\",\"matchCriteriaId\":\"6886CA08-D030-4759-8BE7-8533609150CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.47\",\"versionEndExcluding\":\"4.19.196\",\"matchCriteriaId\":\"027D6865-4845-433B-8B55-C47990C3E764\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.20\",\"versionEndExcluding\":\"5.1\",\"matchCriteriaId\":\"1EA4AB6D-DBA3-4AB5-9C10-75AFA326EF98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1.6\",\"versionEndExcluding\":\"5.4.127\",\"matchCriteriaId\":\"0BB554CE-8CD2-4BC6-AC0C-5338CADEFEAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.45\",\"matchCriteriaId\":\"0CF0334B-62CB-4FBC-8B76-57CC31EBDE56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.12\",\"matchCriteriaId\":\"958321CA-952B-461A-A590-F4096CB20E02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA610E30-717C-4700-9F77-A3C9244F3BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1ECD33F5-85BE-430B-8F86-8D7BD560311D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:00:06+00:00",
      "cve": "CVE-2021-47254",
      "id": "CVE-2021-47254",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gfs2: Fix use-after-free in gfs2_glock_shrink_scan",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47254.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-12T17:16:10Z",
      "cve": "CVE-2021-47254",
      "id": "CVE-2021-47254",
      "initial_release_date": "2024-05-23T03:05:20Z",
      "product_status:known_affected": "416",
      "product_status:known_not_affected": "313",
      "product_status:recommended": "233",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47254",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47254.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.867Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47254\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T17:37:55.520472Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T17:37:56.479Z\"}}], \"cna\": {\"title\": \"gfs2: Fix use-after-free in gfs2_glock_shrink_scan\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is the local GFS2 glock LRU shrinker and glock put path, reached via local filesystem operations and memory reclaim on a mounted GFS2 volume, not via network packet processing.\\nAC:L - An attacker can induce both sides of the race by churning inode/iopen/flock glocks onto the LRU through ordinary file operations while concurrently creating memory pressure to force gfs2_glock_shrink_scan and dispose.\\nPR:L - On a multi-user GFS2 deployment the filesystem is already mounted; an unprivileged local user with access to that mount can trigger glock get/put and reclaim without CAP_SYS_ADMIN.\\nUI:N - No separate victim action is required; the attacker triggers the race through their own filesystem activity and memory allocation once GFS2 is available.\\nS:U - This is a standard in-kernel use-after-free enabling privilege escalation within the same host security authority, not a VM/IOMMU/sandbox boundary crossing.\\nC:H - Use-after-free of a slab-allocated gfs2_glock (aspace) object allows reclaim of attacker-controlled contents and arbitrary kernel memory disclosure primitives.\\nI:H - The same UAF enables heap spraying and corruption of the freed glock object, providing arbitrary write / control-flow hijacking potential in the kernel.\\nA:H - The bug manifests as a kernel use-after-free during list_del in gfs2_dispose_glock_lru (observed under KASAN), which can oops/panic and deny service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6948c6bc17d666663a84c124b3176039e64a58f4\", \"lessThan\": \"38ce329534500bf4ae71f81df6a37a406cf187b4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b568ed385a18c0ddbe41862b69088b636550a04f\", \"lessThan\": \"92869945cc5b78ee8a1ef90336fe070893e3458a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"762bb3528249604bc680a9df635e8995740176de\", \"lessThan\": \"0364742decb0f02bc183404868b82896f7992595\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bac8520892812dada1ac93f27d96317470d24b1f\", \"lessThan\": \"094bf5670e762afa243d2c41a5c4ab71c7447bf4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7881ef3f33bb80f459ea6020d1e021fc524a6348\", \"lessThan\": \"86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7881ef3f33bb80f459ea6020d1e021fc524a6348\", \"lessThan\": \"a61156314b66456ab6a291ed5deba1ebd002ab3c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7881ef3f33bb80f459ea6020d1e021fc524a6348\", \"lessThan\": \"e87ef30fe73e7e10d2c85bdcc778dcec24dca553\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7881ef3f33bb80f459ea6020d1e021fc524a6348\", \"lessThan\": \"1ab19c5de4c537ec0d9b21020395a5b5a6c059b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e7a416fb765c9072479dc424780c0937ba99270\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dcbdbe13796ffa561510d2686a6318564e728bbd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.4.181\", \"lessThan\": \"4.4.274\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.9.180\", \"lessThan\": \"4.9.274\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.14.123\", \"lessThan\": \"4.14.238\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.47\", \"lessThan\": \"4.19.196\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.0.20\", \"lessThan\": \"5.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.1.6\", \"lessThan\": \"5.2\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/gfs2/glock.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.4.274\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.4.*\"}, {\"status\": \"unaffected\", \"version\": \"4.9.274\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.238\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.196\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.127\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.45\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/gfs2/glock.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4\"}, {\"url\": \"https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a\"}, {\"url\": \"https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595\"}, {\"url\": \"https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4\"}, {\"url\": \"https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d\"}, {\"url\": \"https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c\"}, {\"url\": \"https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553\"}, {\"url\": \"https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngfs2: Fix use-after-free in gfs2_glock_shrink_scan\\n\\nThe GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to\\nremove the glock from the lru list in __gfs2_glock_put().\\n\\nOn the shrink scan path, the same flag is cleared under lru_lock but because\\nof cond_resched_lock(\u0026lru_lock) in gfs2_dispose_glock_lru(), progress on the\\nput side can be made without deleting the glock from the lru list.\\n\\nKeep GLF_LRU across the race window opened by cond_resched_lock(\u0026lru_lock) to\\nensure correct behavior on both sides - clear GLF_LRU after list_del under\\nlru_lock.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.4.274\", \"versionStartIncluding\": \"4.4.181\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.274\", \"versionStartIncluding\": \"4.9.180\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.238\", \"versionStartIncluding\": \"4.14.123\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.196\", \"versionStartIncluding\": \"4.19.47\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.127\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.45\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.12\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.0.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.1.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:59.624Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47254\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:59.624Z\", \"dateReserved\": \"2024-04-10T18:59:19.539Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:19:49.475Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.