CVE-2021-47493

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47493", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-22T06:20:56.201Z", "datePublished": "2024-05-22T08:19:41.419Z", "dateUpdated": "2026-08-05T08:48:03.801Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:03.801Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix race between searching chunks and release journal_head from buffer_head\n\nEncountered a race between ocfs2_test_bg_bit_allocatable() and\njbd2_journal_put_journal_head() resulting in the below vmcore.\n\n PID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: \"loop3\"\n Call trace:\n panic\n oops_end\n no_context\n __bad_area_nosemaphore\n bad_area_nosemaphore\n __do_page_fault\n do_page_fault\n page_fault\n [exception RIP: ocfs2_block_group_find_clear_bits+316]\n ocfs2_block_group_find_clear_bits [ocfs2]\n ocfs2_cluster_group_search [ocfs2]\n ocfs2_search_chain [ocfs2]\n ocfs2_claim_suballoc_bits [ocfs2]\n __ocfs2_claim_clusters [ocfs2]\n ocfs2_claim_clusters [ocfs2]\n ocfs2_local_alloc_slide_window [ocfs2]\n ocfs2_reserve_local_alloc_bits [ocfs2]\n ocfs2_reserve_clusters_with_limit [ocfs2]\n ocfs2_reserve_clusters [ocfs2]\n ocfs2_lock_refcount_allocators [ocfs2]\n ocfs2_make_clusters_writable [ocfs2]\n ocfs2_replace_cow [ocfs2]\n ocfs2_refcount_cow [ocfs2]\n ocfs2_file_write_iter [ocfs2]\n lo_rw_aio\n loop_queue_work\n kthread_worker_fn\n kthread\n ret_from_fork\n\nWhen ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the\nbg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and\nreleased the jounal head from the buffer head. Needed to take bit lock\nfor the bit 'BH_JournalHead' to fix this race."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached via local filesystem operations (write/create \u2192 ocfs2_file_write_iter / namei \u2192 ocfs2_reserve_clusters \u2192 ocfs2_block_group_find_clear_bits \u2192 ocfs2_test_bg_bit_allocatable) on a mounted OCFS2 volume, not via network packet processing or physical device attachment.\nAC:L - An unprivileged attacker can drive both sides of the race by running concurrent writers/creators that trigger cluster bitmap searches while forcing journal commits (sync/fsync and heavy metadata activity), so winning the unprotected bh2jh window is attacker-controlled and retryable.\nPR:L - Once OCFS2 is mounted (typical shared-cluster deployment), any unprivileged local user with write permission to files or directories can exercise the allocation path; no CAP_SYS_ADMIN or init-namespace root is required along the vulnerable code path.\nUI:N - The attacker performs the concurrent writes and syncs themselves; no separate victim action such as opening a crafted file or confirming a prompt is required beyond the filesystem already being mounted.\nS:U - Impact is kernel memory corruption / oops within the same host OS authority (OCFS2/JBD2), with no VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Between bh2jh() and use of the journal_head, jbd2 can free the object, creating a use-after-free; per guidance a UAF enables heap reclaim and arbitrary kernel read primitives.\nI:H - The same journal_head UAF (spin_lock and access to b_committed_data on a freed slab object) is exploitable via heap spray for write and control-flow hijacking primitives in the kernel.\nA:H - The observed race already causes a kernel page-fault panic (NULL or dangling journal_head dereference in ocfs2_block_group_find_clear_bits), which is full availability impact even without a complete exploit."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/suballoc.c"], "versions": [{"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "5043fbd294f5909a080ade0f04b70a4da9e122b7", "status": "affected", "versionType": "git"}, {"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "2e382600e8856ea654677b5134ee66e03ea72bc2", "status": "affected", "versionType": "git"}, {"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "6f1b228529ae49b0f85ab89bcdb6c365df401558", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/suballoc.c"], "versions": [{"version": "2.6.16", "status": "affected"}, {"version": "0", "lessThan": "2.6.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.77", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.14.16", "lessThanOrEqual": "5.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.10.77"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.14.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5043fbd294f5909a080ade0f04b70a4da9e122b7"}, {"url": "https://git.kernel.org/stable/c/2e382600e8856ea654677b5134ee66e03ea72bc2"}, {"url": "https://git.kernel.org/stable/c/6f1b228529ae49b0f85ab89bcdb6c365df401558"}], "title": "ocfs2: fix race between searching chunks and release journal_head from buffer_head", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-06T18:35:17.607326Z", "id": "CVE-2021-47493", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-06T18:35:30.175Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.750Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/5043fbd294f5909a080ade0f04b70a4da9e122b7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2e382600e8856ea654677b5134ee66e03ea72bc2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6f1b228529ae49b0f85ab89bcdb6c365df401558", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/5043fbd294f5909a080ade0f04b70a4da9e122b7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2e382600e8856ea654677b5134ee66e03ea72bc2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6f1b228529ae49b0f85ab89bcdb6c365df401558", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.750Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-06T18:35:17.607326Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-06T18:35:25.585Z"}}], "cna": {"title": "ocfs2: fix race between searching chunks and release journal_head from buffer_head", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached via local filesystem operations (write/create \u2192 ocfs2_file_write_iter / namei \u2192 ocfs2_reserve_clusters \u2192 ocfs2_block_group_find_clear_bits \u2192 ocfs2_test_bg_bit_allocatable) on a mounted OCFS2 volume, not via network packet processing or physical device attachment.\nAC:L - An unprivileged attacker can drive both sides of the race by running concurrent writers/creators that trigger cluster bitmap searches while forcing journal commits (sync/fsync and heavy metadata activity), so winning the unprotected bh2jh window is attacker-controlled and retryable.\nPR:L - Once OCFS2 is mounted (typical shared-cluster deployment), any unprivileged local user with write permission to files or directories can exercise the allocation path; no CAP_SYS_ADMIN or init-namespace root is required along the vulnerable code path.\nUI:N - The attacker performs the concurrent writes and syncs themselves; no separate victim action such as opening a crafted file or confirming a prompt is required beyond the filesystem already being mounted.\nS:U - Impact is kernel memory corruption / oops within the same host OS authority (OCFS2/JBD2), with no VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Between bh2jh() and use of the journal_head, jbd2 can free the object, creating a use-after-free; per guidance a UAF enables heap reclaim and arbitrary kernel read primitives.\nI:H - The same journal_head UAF (spin_lock and access to b_committed_data on a freed slab object) is exploitable via heap spray for write and control-flow hijacking primitives in the kernel.\nA:H - The observed race already causes a kernel page-fault panic (NULL or dangling journal_head dereference in ocfs2_block_group_find_clear_bits), which is full availability impact even without a complete exploit."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "5043fbd294f5909a080ade0f04b70a4da9e122b7", "versionType": "git"}, {"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "2e382600e8856ea654677b5134ee66e03ea72bc2", "versionType": "git"}, {"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "6f1b228529ae49b0f85ab89bcdb6c365df401558", "versionType": "git"}], "programFiles": ["fs/ocfs2/suballoc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.16"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.77", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.14.16", "versionType": "semver", "lessThanOrEqual": "5.14.*"}, {"status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ocfs2/suballoc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5043fbd294f5909a080ade0f04b70a4da9e122b7"}, {"url": "https://git.kernel.org/stable/c/2e382600e8856ea654677b5134ee66e03ea72bc2"}, {"url": "https://git.kernel.org/stable/c/6f1b228529ae49b0f85ab89bcdb6c365df401558"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix race between searching chunks and release journal_head from buffer_head\n\nEncountered a race between ocfs2_test_bg_bit_allocatable() and\njbd2_journal_put_journal_head() resulting in the below vmcore.\n\n PID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: \"loop3\"\n Call trace:\n panic\n oops_end\n no_context\n __bad_area_nosemaphore\n bad_area_nosemaphore\n __do_page_fault\n do_page_fault\n page_fault\n [exception RIP: ocfs2_block_group_find_clear_bits+316]\n ocfs2_block_group_find_clear_bits [ocfs2]\n ocfs2_cluster_group_search [ocfs2]\n ocfs2_search_chain [ocfs2]\n ocfs2_claim_suballoc_bits [ocfs2]\n __ocfs2_claim_clusters [ocfs2]\n ocfs2_claim_clusters [ocfs2]\n ocfs2_local_alloc_slide_window [ocfs2]\n ocfs2_reserve_local_alloc_bits [ocfs2]\n ocfs2_reserve_clusters_with_limit [ocfs2]\n ocfs2_reserve_clusters [ocfs2]\n ocfs2_lock_refcount_allocators [ocfs2]\n ocfs2_make_clusters_writable [ocfs2]\n ocfs2_replace_cow [ocfs2]\n ocfs2_refcount_cow [ocfs2]\n ocfs2_file_write_iter [ocfs2]\n lo_rw_aio\n loop_queue_work\n kthread_worker_fn\n kthread\n ret_from_fork\n\nWhen ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the\nbg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and\nreleased the jounal head from the buffer head. Needed to take bit lock\nfor the bit 'BH_JournalHead' to fix this race."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.77", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.14.16", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15", "versionStartIncluding": "2.6.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:03.801Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47493", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:48:03.801Z", "dateReserved": "2024-05-22T06:20:56.201Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-22T08:19:41.419Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ocfs2/suballoc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5043fbd294f5909a080ade0f04b70a4da9e122b7", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}, {"lessThan": "2e382600e8856ea654677b5134ee66e03ea72bc2", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}, {"lessThan": "6f1b228529ae49b0f85ab89bcdb6c365df401558", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ocfs2/suballoc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.16"}, {"lessThan": "2.6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.77", "versionType": "semver"}, {"lessThanOrEqual": "5.14.*", "status": "unaffected", "version": "5.14.16", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF93F2A0-1BCC-4EC3-AF79-F186B97DF86D", "versionEndExcluding": "5.10.77", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2681B950-4548-4649-A9E1-4124B59FC09C", "versionEndExcluding": "5.14.16", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "E46C74C6-B76B-4C94-A6A4-FD2FFF62D644", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "60134C3A-06E4-48C1-B04F-2903732A4E56", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "0460DA88-8FE1-46A2-9DDA-1F1ABA552E71", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "AF55383D-4DF2-45DC-93F7-571F4F978EAB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*", "matchCriteriaId": "9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*", "matchCriteriaId": "EBD45831-4B79-42BC-ABC0-86870F0DEA89", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*", "matchCriteriaId": "948A6B8D-1B72-4945-8680-354E53BE1C80", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix race between searching chunks and release journal_head from buffer_head\n\nEncountered a race between ocfs2_test_bg_bit_allocatable() and\njbd2_journal_put_journal_head() resulting in the below vmcore.\n\n PID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: \"loop3\"\n Call trace:\n panic\n oops_end\n no_context\n __bad_area_nosemaphore\n bad_area_nosemaphore\n __do_page_fault\n do_page_fault\n page_fault\n [exception RIP: ocfs2_block_group_find_clear_bits+316]\n ocfs2_block_group_find_clear_bits [ocfs2]\n ocfs2_cluster_group_search [ocfs2]\n ocfs2_search_chain [ocfs2]\n ocfs2_claim_suballoc_bits [ocfs2]\n __ocfs2_claim_clusters [ocfs2]\n ocfs2_claim_clusters [ocfs2]\n ocfs2_local_alloc_slide_window [ocfs2]\n ocfs2_reserve_local_alloc_bits [ocfs2]\n ocfs2_reserve_clusters_with_limit [ocfs2]\n ocfs2_reserve_clusters [ocfs2]\n ocfs2_lock_refcount_allocators [ocfs2]\n ocfs2_make_clusters_writable [ocfs2]\n ocfs2_replace_cow [ocfs2]\n ocfs2_refcount_cow [ocfs2]\n ocfs2_file_write_iter [ocfs2]\n lo_rw_aio\n loop_queue_work\n kthread_worker_fn\n kthread\n ret_from_fork\n\nWhen ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the\nbg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and\nreleased the jounal head from the buffer head. Needed to take bit lock\nfor the bit 'BH_JournalHead' to fix this race."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ocfs2: corrige la ejecuci\u00f3n entre fragmentos de b\u00fasqueda y libera journal_head de buffer_head Se encontr\u00f3 una ejecuci\u00f3n entre ocfs2_test_bg_bit_allocatable() y jbd2_journal_put_journal_head() que result\u00f3 en el siguiente vmcore. PID: 106879 TAREA: ffff880244ba9c00 CPU: 2 COMANDO: \"loop3\" Rastreo de llamadas: p\u00e1nico oops_end no_context __bad_area_nosemaphore bad_area_nosemaphore __do_page_fault do_page_fault page_fault [excepci\u00f3n RIP: ocfs2_block_group_find_clear_bits+316] 2_block_group_find_clear_bits [ocfs2] ocfs2_cluster_group_search [ocfs2] ocfs2_search_chain [ocfs2] ocfs2_claim_suballoc_bits [ocfs2] __ocfs2_claim_clusters [ocfs2] ocfs2_claim_clusters [ocfs2] ocfs2_local_alloc_slide_window [ocfs2] ocfs2_reserve_local_alloc_bits [ocfs2] ocfs2_reserve_clusters_with_limit [ocfs2] ocfs2_reserve_clusters [ocfs2] ocfs2_lock_refcount_allocators [ocfs2] 2_make_clusters_writable [ocfs2] ocfs2_replace_cow [ocfs2] ocfs2_refcount_cow [ocfs2] ocfs2_file_write_iter [ocfs2] lo_rw_aio loop_queue_work kthread_worker_fn kthread ret_from_fork Cuando ocfs2_test_bg_bit_allocatable () llamado bh2jh(bg_bh), el bg_bh->b_private NULL como jbd2_journal_put_journal_head() corri\u00f3 y liber\u00f3 el encabezado del diario del encabezado del b\u00fafer. Era necesario bloquear el bit 'BH_JournalHead' para solucionar esta ejecuci\u00f3n."}], "id": "CVE-2021-47493", "lastModified": "2026-08-04T10:17:05.613", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47493", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-06T18:35:17.607326Z", "version": "2.0.3"}}]}, "published": "2024-05-22T09:15:11.100", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e382600e8856ea654677b5134ee66e03ea72bc2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5043fbd294f5909a080ade0f04b70a4da9e122b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6f1b228529ae49b0f85ab89bcdb6c365df401558"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e382600e8856ea654677b5134ee66e03ea72bc2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5043fbd294f5909a080ade0f04b70a4da9e122b7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6f1b228529ae49b0f85ab89bcdb6c365df401558"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ocfs2: fix race between searching chunks and release journal_head from buffer_head", "id": "2282922", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282922"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-362", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nocfs2: fix race between searching chunks and release journal_head from buffer_head\nEncountered a race between ocfs2_test_bg_bit_allocatable() and\njbd2_journal_put_journal_head() resulting in the below vmcore.\nPID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: \"loop3\"\nCall trace:\npanic\noops_end\nno_context\n__bad_area_nosemaphore\nbad_area_nosemaphore\n__do_page_fault\ndo_page_fault\npage_fault\n[exception RIP: ocfs2_block_group_find_clear_bits+316]\nocfs2_block_group_find_clear_bits [ocfs2]\nocfs2_cluster_group_search [ocfs2]\nocfs2_search_chain [ocfs2]\nocfs2_claim_suballoc_bits [ocfs2]\n__ocfs2_claim_clusters [ocfs2]\nocfs2_claim_clusters [ocfs2]\nocfs2_local_alloc_slide_window [ocfs2]\nocfs2_reserve_local_alloc_bits [ocfs2]\nocfs2_reserve_clusters_with_limit [ocfs2]\nocfs2_reserve_clusters [ocfs2]\nocfs2_lock_refcount_allocators [ocfs2]\nocfs2_make_clusters_writable [ocfs2]\nocfs2_replace_cow [ocfs2]\nocfs2_refcount_cow [ocfs2]\nocfs2_file_write_iter [ocfs2]\nlo_rw_aio\nloop_queue_work\nkthread_worker_fn\nkthread\nret_from_fork\nWhen ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the\nbg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and\nreleased the jounal head from the buffer head. Needed to take bit lock\nfor the bit 'BH_JournalHead' to fix this race."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2021-47493", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47493\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47493\nhttps://lore.kernel.org/linux-cve-announce/2024052241-CVE-2021-47493-24fb@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{"created": "2025-07-13T11:14:44.844701+00:00", "updated": "2025-07-13T11:14:44.844750+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}