CVE-2021-47351

ubifs: Fix races between xattr_{set|get} and listxattr operations

State: Published
Severity: 7.8 High
Published: May 21, 2024
Updated: Aug 5, 2026
Reserved: May 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ubifs: Fix races between xattr_{set|get} and listxattr operations

UBIFS may occur some problems with concurrent xattr_{set|get} and listxattr operations, such as assertion failure, memory corruption, stale xattr value[1].

Fix it by importing a new rw-lock in @ubifs_inode to serilize write operations on xattr, concurrent read operations are still effective, just like ext4.

[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08Affected 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 38dde03eb239605f428f3f1e4baa73d4933a4cc6Affected 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 9558612cb829f2c022b788f55d6b8437d5234a82Affected 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before c0756f75c22149d20fcb7d8409827cee905eb386Affected 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before f4e3634a3b642225a530c292fdb1e8a4007507f5Affected
LinuxLinux	2.6.27Affected before 2.6.27Not affected 5.4.133 through 5.4.Not affected 5.10.51 through 5.10.Not affected 5.12.18 through 5.12.Not affected 5.13.3 through 5.13.Not affected 5.14 and laterNot affected

Product

Versions

LinuxLinux

1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08Affected
1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 38dde03eb239605f428f3f1e4baa73d4933a4cc6Affected
1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 9558612cb829f2c022b788f55d6b8437d5234a82Affected
1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before c0756f75c22149d20fcb7d8409827cee905eb386Affected
1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before f4e3634a3b642225a530c292fdb1e8a4007507f5Affected

LinuxLinux

2.6.27Affected
before 2.6.27Not affected
5.4.133 through 5.4.*Not affected
5.10.51 through 5.10.*Not affected
5.12.18 through 5.12.*Not affected
5.13.3 through 5.13.*Not affected
5.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.