CVE-2021-46982 (GCVE-0-2021-46982)
Vulnerability from cvelistv5 – Published: 2024-02-28 08:13 – Updated: 2025-05-04 07:01
VLAI?
Title
f2fs: compress: fix race condition of overwrite vs truncate
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: compress: fix race condition of overwrite vs truncate
pos_fsstress testcase complains a panic as belew:
------------[ cut here ]------------
kernel BUG at fs/f2fs/compress.c:1082!
invalid opcode: 0000 [#1] SMP PTI
CPU: 4 PID: 2753477 Comm: kworker/u16:2 Tainted: G OE 5.12.0-rc1-custom #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
Workqueue: writeback wb_workfn (flush-252:16)
RIP: 0010:prepare_compress_overwrite+0x4c0/0x760 [f2fs]
Call Trace:
f2fs_prepare_compress_overwrite+0x5f/0x80 [f2fs]
f2fs_write_cache_pages+0x468/0x8a0 [f2fs]
f2fs_write_data_pages+0x2a4/0x2f0 [f2fs]
do_writepages+0x38/0xc0
__writeback_single_inode+0x44/0x2a0
writeback_sb_inodes+0x223/0x4d0
__writeback_inodes_wb+0x56/0xf0
wb_writeback+0x1dd/0x290
wb_workfn+0x309/0x500
process_one_work+0x220/0x3c0
worker_thread+0x53/0x420
kthread+0x12f/0x150
ret_from_fork+0x22/0x30
The root cause is truncate() may race with overwrite as below,
so that one reference count left in page can not guarantee the
page attaching in mapping tree all the time, after truncation,
later find_lock_page() may return NULL pointer.
- prepare_compress_overwrite
- f2fs_pagecache_get_page
- unlock_page
- f2fs_setattr
- truncate_setsize
- truncate_inode_page
- delete_from_page_cache
- find_lock_page
Fix this by avoiding referencing updated page.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
4c8ff7095bef64fc47e996a938f7d57f9e077da3 , < 5639b73fd3bc6fc8ca72e3a9ac15aacaabd7ebff
(git)
Affected: 4c8ff7095bef64fc47e996a938f7d57f9e077da3 , < 64acb100fe3beb5d20184d0ae3307235bd3555c4 (git) Affected: 4c8ff7095bef64fc47e996a938f7d57f9e077da3 , < 936158b15e2648253afb824d252c910c496d34b5 (git) Affected: 4c8ff7095bef64fc47e996a938f7d57f9e077da3 , < a949dc5f2c5cfe0c910b664650f45371254c0744 (git) |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:24:37.888Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/5639b73fd3bc6fc8ca72e3a9ac15aacaabd7ebff"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/64acb100fe3beb5d20184d0ae3307235bd3555c4"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/936158b15e2648253afb824d252c910c496d34b5"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a949dc5f2c5cfe0c910b664650f45371254c0744"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-46982",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T16:01:14.834771Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:33:41.281Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/compress.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5639b73fd3bc6fc8ca72e3a9ac15aacaabd7ebff",
"status": "affected",
"version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
"versionType": "git"
},
{
"lessThan": "64acb100fe3beb5d20184d0ae3307235bd3555c4",
"status": "affected",
"version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
"versionType": "git"
},
{
"lessThan": "936158b15e2648253afb824d252c910c496d34b5",
"status": "affected",
"version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
"versionType": "git"
},
{
"lessThan": "a949dc5f2c5cfe0c910b664650f45371254c0744",
"status": "affected",
"version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/compress.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.11.*",
"status": "unaffected",
"version": "5.11.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.12.*",
"status": "unaffected",
"version": "5.12.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.38",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.22",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.12.5",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.13",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix race condition of overwrite vs truncate\n\npos_fsstress testcase complains a panic as belew:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/compress.c:1082!\ninvalid opcode: 0000 [#1] SMP PTI\nCPU: 4 PID: 2753477 Comm: kworker/u16:2 Tainted: G OE 5.12.0-rc1-custom #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nWorkqueue: writeback wb_workfn (flush-252:16)\nRIP: 0010:prepare_compress_overwrite+0x4c0/0x760 [f2fs]\nCall Trace:\n f2fs_prepare_compress_overwrite+0x5f/0x80 [f2fs]\n f2fs_write_cache_pages+0x468/0x8a0 [f2fs]\n f2fs_write_data_pages+0x2a4/0x2f0 [f2fs]\n do_writepages+0x38/0xc0\n __writeback_single_inode+0x44/0x2a0\n writeback_sb_inodes+0x223/0x4d0\n __writeback_inodes_wb+0x56/0xf0\n wb_writeback+0x1dd/0x290\n wb_workfn+0x309/0x500\n process_one_work+0x220/0x3c0\n worker_thread+0x53/0x420\n kthread+0x12f/0x150\n ret_from_fork+0x22/0x30\n\nThe root cause is truncate() may race with overwrite as below,\nso that one reference count left in page can not guarantee the\npage attaching in mapping tree all the time, after truncation,\nlater find_lock_page() may return NULL pointer.\n\n- prepare_compress_overwrite\n - f2fs_pagecache_get_page\n - unlock_page\n\t\t\t\t\t- f2fs_setattr\n\t\t\t\t\t - truncate_setsize\n\t\t\t\t\t - truncate_inode_page\n\t\t\t\t\t - delete_from_page_cache\n - find_lock_page\n\nFix this by avoiding referencing updated page."
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T07:01:41.745Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5639b73fd3bc6fc8ca72e3a9ac15aacaabd7ebff"
},
{
"url": "https://git.kernel.org/stable/c/64acb100fe3beb5d20184d0ae3307235bd3555c4"
},
{
"url": "https://git.kernel.org/stable/c/936158b15e2648253afb824d252c910c496d34b5"
},
{
"url": "https://git.kernel.org/stable/c/a949dc5f2c5cfe0c910b664650f45371254c0744"
}
],
"title": "f2fs: compress: fix race condition of overwrite vs truncate",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-46982",
"datePublished": "2024-02-28T08:13:11.585Z",
"dateReserved": "2024-02-27T18:42:55.946Z",
"dateUpdated": "2025-05-04T07:01:41.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2021-46982\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-02-28T09:15:37.367\",\"lastModified\":\"2024-12-31T16:08:54.203\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: compress: fix race condition of overwrite vs truncate\\n\\npos_fsstress testcase complains a panic as belew:\\n\\n------------[ cut here ]------------\\nkernel BUG at fs/f2fs/compress.c:1082!\\ninvalid opcode: 0000 [#1] SMP PTI\\nCPU: 4 PID: 2753477 Comm: kworker/u16:2 Tainted: G OE 5.12.0-rc1-custom #1\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\\nWorkqueue: writeback wb_workfn (flush-252:16)\\nRIP: 0010:prepare_compress_overwrite+0x4c0/0x760 [f2fs]\\nCall Trace:\\n f2fs_prepare_compress_overwrite+0x5f/0x80 [f2fs]\\n f2fs_write_cache_pages+0x468/0x8a0 [f2fs]\\n f2fs_write_data_pages+0x2a4/0x2f0 [f2fs]\\n do_writepages+0x38/0xc0\\n __writeback_single_inode+0x44/0x2a0\\n writeback_sb_inodes+0x223/0x4d0\\n __writeback_inodes_wb+0x56/0xf0\\n wb_writeback+0x1dd/0x290\\n wb_workfn+0x309/0x500\\n process_one_work+0x220/0x3c0\\n worker_thread+0x53/0x420\\n kthread+0x12f/0x150\\n ret_from_fork+0x22/0x30\\n\\nThe root cause is truncate() may race with overwrite as below,\\nso that one reference count left in page can not guarantee the\\npage attaching in mapping tree all the time, after truncation,\\nlater find_lock_page() may return NULL pointer.\\n\\n- prepare_compress_overwrite\\n - f2fs_pagecache_get_page\\n - unlock_page\\n\\t\\t\\t\\t\\t- f2fs_setattr\\n\\t\\t\\t\\t\\t - truncate_setsize\\n\\t\\t\\t\\t\\t - truncate_inode_page\\n\\t\\t\\t\\t\\t - delete_from_page_cache\\n - find_lock_page\\n\\nFix this by avoiding referencing updated page.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: comprimir: corregir la condici\u00f3n de ejecuci\u00f3n de sobrescritura frente a truncar pos_fsstress testcase presenta un p\u00e1nico como se muestra a continuaci\u00f3n: ------------[ cortar aqu\u00ed ]--- --------- \u00a1ERROR del kernel en fs/f2fs/compress.c:1082! c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] SMP PTI CPU: 4 PID: 2753477 Comm: kworker/u16:2 Contaminado: G OE 5.12.0-rc1-custom #1 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.14.0-2 01/04/2014 Cola de trabajo: reescritura wb_workfn (flush-252:16) RIP: 0010:prepare_compress_overwrite+0x4c0/0x760 [f2fs] Seguimiento de llamadas: f2fs_prepare_compress_overwrite+0x5f/0x80 [f2fs] f2fs_write_cache_pages+ 0x468/0x8a0 [f2fs] f2fs_write_data_pages+0x2a4/0x2f0 [f2fs] do_writepages+0x38/0xc0 __writeback_single_inode+0x44/0x2a0 writeback_sb_inodes+0x223/0x4d0 __writeback_inodes_wb+0x56/0xf0 wb_writeback+0x1dd/0 x290 wb_workfn+0x309/0x500 proceso_one_work+0x220/0x3c0 trabajador_thread+0x53/ 0x420 kthread+0x12f/0x150 ret_from_fork+0x22/0x30 La causa principal es que truncate() puede correr con sobrescritura como se muestra a continuaci\u00f3n, por lo que un recuento de referencias restante en la p\u00e1gina no puede garantizar que la p\u00e1gina se adjunte en el \u00e1rbol de mapeo todo el tiempo, despu\u00e9s del truncamiento, m\u00e1s adelante find_lock_page() puede devolver un puntero NULL. - prepare_compress_overwrite - f2fs_pagecache_get_page - unlock_page - f2fs_setattr - truncate_setsize - truncate_inode_page - delete_from_page_cache - find_lock_page Solucione este problema evitando hacer referencia a la p\u00e1gina actualizada.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.6\",\"versionEndExcluding\":\"5.10.38\",\"matchCriteriaId\":\"E13DFC88-3633-414B-8409-9272DE29A99C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.11.22\",\"matchCriteriaId\":\"83B53E9A-F426-4C03-9A5F-A931FF79827E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.12.5\",\"matchCriteriaId\":\"0274929A-B36C-4F4C-AB22-30A0DD6B995B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5639b73fd3bc6fc8ca72e3a9ac15aacaabd7ebff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/64acb100fe3beb5d20184d0ae3307235bd3555c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/936158b15e2648253afb824d252c910c496d34b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a949dc5f2c5cfe0c910b664650f45371254c0744\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5639b73fd3bc6fc8ca72e3a9ac15aacaabd7ebff\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/64acb100fe3beb5d20184d0ae3307235bd3555c4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/936158b15e2648253afb824d252c910c496d34b5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a949dc5f2c5cfe0c910b664650f45371254c0744\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5639b73fd3bc6fc8ca72e3a9ac15aacaabd7ebff\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/64acb100fe3beb5d20184d0ae3307235bd3555c4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/936158b15e2648253afb824d252c910c496d34b5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a949dc5f2c5cfe0c910b664650f45371254c0744\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:37.888Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-46982\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:01:14.834771Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:18.135Z\"}}], \"cna\": {\"title\": \"f2fs: compress: fix race condition of overwrite vs truncate\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4c8ff7095bef64fc47e996a938f7d57f9e077da3\", \"lessThan\": \"5639b73fd3bc6fc8ca72e3a9ac15aacaabd7ebff\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4c8ff7095bef64fc47e996a938f7d57f9e077da3\", \"lessThan\": \"64acb100fe3beb5d20184d0ae3307235bd3555c4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4c8ff7095bef64fc47e996a938f7d57f9e077da3\", \"lessThan\": \"936158b15e2648253afb824d252c910c496d34b5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4c8ff7095bef64fc47e996a938f7d57f9e077da3\", \"lessThan\": \"a949dc5f2c5cfe0c910b664650f45371254c0744\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/f2fs/compress.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.38\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.11.22\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.11.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/f2fs/compress.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5639b73fd3bc6fc8ca72e3a9ac15aacaabd7ebff\"}, {\"url\": \"https://git.kernel.org/stable/c/64acb100fe3beb5d20184d0ae3307235bd3555c4\"}, {\"url\": \"https://git.kernel.org/stable/c/936158b15e2648253afb824d252c910c496d34b5\"}, {\"url\": \"https://git.kernel.org/stable/c/a949dc5f2c5cfe0c910b664650f45371254c0744\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: compress: fix race condition of overwrite vs truncate\\n\\npos_fsstress testcase complains a panic as belew:\\n\\n------------[ cut here ]------------\\nkernel BUG at fs/f2fs/compress.c:1082!\\ninvalid opcode: 0000 [#1] SMP PTI\\nCPU: 4 PID: 2753477 Comm: kworker/u16:2 Tainted: G OE 5.12.0-rc1-custom #1\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\\nWorkqueue: writeback wb_workfn (flush-252:16)\\nRIP: 0010:prepare_compress_overwrite+0x4c0/0x760 [f2fs]\\nCall Trace:\\n f2fs_prepare_compress_overwrite+0x5f/0x80 [f2fs]\\n f2fs_write_cache_pages+0x468/0x8a0 [f2fs]\\n f2fs_write_data_pages+0x2a4/0x2f0 [f2fs]\\n do_writepages+0x38/0xc0\\n __writeback_single_inode+0x44/0x2a0\\n writeback_sb_inodes+0x223/0x4d0\\n __writeback_inodes_wb+0x56/0xf0\\n wb_writeback+0x1dd/0x290\\n wb_workfn+0x309/0x500\\n process_one_work+0x220/0x3c0\\n worker_thread+0x53/0x420\\n kthread+0x12f/0x150\\n ret_from_fork+0x22/0x30\\n\\nThe root cause is truncate() may race with overwrite as below,\\nso that one reference count left in page can not guarantee the\\npage attaching in mapping tree all the time, after truncation,\\nlater find_lock_page() may return NULL pointer.\\n\\n- prepare_compress_overwrite\\n - f2fs_pagecache_get_page\\n - unlock_page\\n\\t\\t\\t\\t\\t- f2fs_setattr\\n\\t\\t\\t\\t\\t - truncate_setsize\\n\\t\\t\\t\\t\\t - truncate_inode_page\\n\\t\\t\\t\\t\\t - delete_from_page_cache\\n - find_lock_page\\n\\nFix this by avoiding referencing updated page.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.38\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.11.22\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.5\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"5.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:01:41.745Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-46982\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:01:41.745Z\", \"dateReserved\": \"2024-02-27T18:42:55.946Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-28T08:13:11.585Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…