nvd-json-data-feeds/CVE-2021/CVE-2021-476xx/CVE-2021-47638.json

{
  "id": "CVE-2021-47638",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-02-26T06:37:05.580",
  "lastModified": "2025-03-18T19:08:37.783",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: rename_whiteout: Fix double free for whiteout_ui->data\n\n'whiteout_ui->data' will be freed twice if space budget fail for\nrename whiteout operation as following process:\n\nrename_whiteout\n  dev = kmalloc\n  whiteout_ui->data = dev\n  kfree(whiteout_ui->data)  // Free first time\n  iput(whiteout)\n    ubifs_free_inode\n      kfree(ui->data)\t    // Double free!\n\nKASAN reports:\n==================================================================\nBUG: KASAN: double-free or invalid-free in ubifs_free_inode+0x4f/0x70\nCall Trace:\n  kfree+0x117/0x490\n  ubifs_free_inode+0x4f/0x70 [ubifs]\n  i_callback+0x30/0x60\n  rcu_do_batch+0x366/0xac0\n  __do_softirq+0x133/0x57f\n\nAllocated by task 1506:\n  kmem_cache_alloc_trace+0x3c2/0x7a0\n  do_rename+0x9b7/0x1150 [ubifs]\n  ubifs_rename+0x106/0x1f0 [ubifs]\n  do_syscall_64+0x35/0x80\n\nFreed by task 1506:\n  kfree+0x117/0x490\n  do_rename.cold+0x53/0x8a [ubifs]\n  ubifs_rename+0x106/0x1f0 [ubifs]\n  do_syscall_64+0x35/0x80\n\nThe buggy address belongs to the object at ffff88810238bed8 which\nbelongs to the cache kmalloc-8 of size 8\n==================================================================\n\nLet ubifs_free_inode() free 'whiteout_ui->data'. BTW, delete unused\nassignment 'whiteout_ui->data_len = 0', process 'ubifs_evict_inode()\n-> ubifs_jnl_delete_inode() -> ubifs_jnl_write_inode()' doesn't need it\n(because 'inc_nlink(whiteout)' won't be excuted by 'goto out_release',\n and the nlink of whiteout inode is 0)."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ubifs: rename_whiteout: Se corrige la doble liberaci\u00f3n para whiteout_ui->data 'whiteout_ui->data' se liberar\u00e1 dos veces si el presupuesto de espacio falla para la operaci\u00f3n de cambio de nombre de whiteout como el siguiente proceso: rename_whiteout dev = kmalloc whiteout_ui->data = dev kfree(whiteout_ui->data) // Libera la primera vez iput(whiteout) ubifs_free_inode kfree(ui->data) // \u00a1Doble liberaci\u00f3n! KASAN informa: ==================================================================== ERROR: KASAN: liberaci\u00f3n doble o liberaci\u00f3n no v\u00e1lida en ubifs_free_inode+0x4f/0x70 Seguimiento de llamadas: kfree+0x117/0x490 ubifs_free_inode+0x4f/0x70 [ubifs] i_callback+0x30/0x60 rcu_do_batch+0x366/0xac0 __do_softirq+0x133/0x57f Asignado por la tarea 1506: kmem_cache_alloc_trace+0x3c2/0x7a0 do_rename+0x9b7/0x1150 [ubifs] ubifs_rename+0x106/0x1f0 [ubifs] do_syscall_64+0x35/0x80 Liberado por la tarea 1506: kfree+0x117/0x490 do_rename.cold+0x53/0x8a [ubifs] ubifs_rename+0x106/0x1f0 [ubifs] do_syscall_64+0x35/0x80 La direcci\u00f3n con errores pertenece al objeto en ffff88810238bed8 que pertenece al cach\u00e9 kmalloc-8 de tama\u00f1o 8 ===================================================================== Deje que ubifs_free_inode() libere 'whiteout_ui->data'. Por cierto, elimine la asignaci\u00f3n no utilizada 'whiteout_ui->data_len = 0', el proceso 'ubifs_evict_inode() -> ubifs_jnl_delete_inode() -> ubifs_jnl_write_inode()' no lo necesita (porque 'inc_nlink(whiteout)' no ser\u00e1 ejecutado por 'goto out_release', y el nlink del inodo whiteout es 0)."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-415"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.9",
              "versionEndExcluding": "4.14.276",
              "matchCriteriaId": "EA8D1234-835A-47E7-8014-55948757E778"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.15",
              "versionEndExcluding": "4.19.238",
              "matchCriteriaId": "FA28527A-11D3-41D2-9C4C-ECAC0D6A4A2D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.20",
              "versionEndExcluding": "5.4.189",
              "matchCriteriaId": "8CB6E8F5-C2B1-46F3-A807-0F6104AC340F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.5",
              "versionEndExcluding": "5.10.110",
              "matchCriteriaId": "91D3BFD0-D3F3-4018-957C-96CCBF357D79"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.11",
              "versionEndExcluding": "5.15.33",
              "matchCriteriaId": "27C42AE8-B387-43E2-938A-E1C8B40BE6D5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.16",
              "versionEndExcluding": "5.16.19",
              "matchCriteriaId": "20C43679-0439-405A-B97F-685BEE50613B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.17",
              "versionEndExcluding": "5.17.2",
              "matchCriteriaId": "210C679C-CF84-44A3-8939-E629C87E54BF"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/14276d38c89a170363e90b6ac0a53c3cf61b87fc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/2ad07009c459e56ebdcc089d850d664660fdb742",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/2b3236ecf96db7af5836e1366ce39ace8ce832fa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/40a8f0d5e7b3999f096570edab71c345da812e3e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/6d7a158a7363c1f6604aa47ae1a280a5c65123dd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/8b3c7be16f3f4dfd6e15ac651484e59d3fa36274",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/a90e2dbe66d2647ff95a0442ad2e86482d977fd8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/b9a937f096e608b3368c1abc920d4d640ba2c94f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}