CVE-2021-4155

First published: Wed Dec 22 2021(Updated: )

A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them.

Credit: secalert@redhat.com secalert@redhat.com

Affected Software	Affected Version	How to fix
redhat/kernel	<0:2.6.32-754.47.1.el6	0:2.6.32-754.47.1.el6
redhat/kernel-rt	<0:3.10.0-1160.59.1.rt56.1200.el7	0:3.10.0-1160.59.1.rt56.1200.el7
redhat/kernel	<0:3.10.0-1160.59.1.el7	0:3.10.0-1160.59.1.el7
redhat/kernel	<0:3.10.0-514.97.1.el7	0:3.10.0-514.97.1.el7
redhat/kernel	<0:3.10.0-693.96.1.el7	0:3.10.0-693.96.1.el7
redhat/kernel	<0:3.10.0-957.88.1.el7	0:3.10.0-957.88.1.el7
redhat/kernel	<0:3.10.0-1062.63.1.el7	0:3.10.0-1062.63.1.el7
redhat/kernel-rt	<0:4.18.0-348.12.2.rt7.143.el8_5	0:4.18.0-348.12.2.rt7.143.el8_5
redhat/kernel	<0:4.18.0-348.12.2.el8_5	0:4.18.0-348.12.2.el8_5
redhat/kernel	<0:4.18.0-147.59.1.el8_1	0:4.18.0-147.59.1.el8_1
redhat/kernel-rt	<0:4.18.0-193.75.1.rt13.125.el8_2	0:4.18.0-193.75.1.rt13.125.el8_2
redhat/kernel	<0:4.18.0-193.75.1.el8_2	0:4.18.0-193.75.1.el8_2
redhat/kernel-rt	<0:4.18.0-305.34.2.rt7.107.el8_4	0:4.18.0-305.34.2.rt7.107.el8_4
redhat/kernel	<0:4.18.0-305.34.2.el8_4	0:4.18.0-305.34.2.el8_4
redhat/redhat-virtualization-host	<0:4.3.22-20220330.1.el7_9	0:4.3.22-20220330.1.el7_9
Linux Linux kernel	<5.16
redhat/Kernel	<5.16	5.16
debian/linux		5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.12.5-1 6.12.6-1

Remedy

This issue can be mitigated by ensuring xfs_alloc_file_space is not called with "0" as an argument. This can be done with a SystemTap script (which resets "0" with XFS_BMAPI_PREALLOC), below are the steps: 1) Save the following script in a 'CVE-2021-4155.stp' file --- On Red Hat Enterprise Linux 6 --- probe module("xfs").function("xfs_alloc_file_space") { if ($alloc_type == 0) $alloc_type = 0x40;# XFS_BMAPI_PREALLOC } --- On Red Hat Enterprise Linux 6 --- --- On Red Hat Enterprise Linux 7 onwards --- probe module("xfs").function("xfs_alloc_file_space") { if ($alloc_type == 0) $alloc_type = 0x8;# XFS_BMAPI_PREALLOC } --- On Red Hat Enterprise Linux 7 onwards --- 2) Install systemtap package and its dependencies # yum install -y systemtap systemtap-runtime # yum install -y kernel-devel kernel-debuginfo 3) Build the mitigation kernel module as root. # stap -r `uname -r` -m cve_2021_4155.ko -g CVE-2021-4155.stp -p4 4) Load the mitigation module as root # staprun -L cve_2021_4155.ko What is SystemTap and how to use it? https://access.redhat.com/solutions/5441

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=983d8e60f50806f90534cc5373d0ce867e5aaf79

Remedy

https://www.openwall.com/lists/oss-security/2022/01/10/1

Never miss a vulnerability like this again

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

collector/redhat-cve
collector/nvd-index
agent/type
agent/first-publish-date
collector/launchpad-cve
source/Launchpad
agent/author
agent/weakness
agent/severity
collector/redhat-bugzilla
source/Red Hat
alias/CVE-2021-4155
agent/software-canonical-lookup
collector/mitre-cve
source/MITRE
collector/usn-cve
source/Ubuntu
collector/nvd-cve
source/NVD
collector/security-tracker-debian
source/Debian
agent/last-modified-date
agent/references
agent/remedy
agent/tags
agent/description
agent/softwarecombine
agent/event
agent/trending
package-manager/redhat
vendor/linux
canonical/linux linux kernel
package-manager/debian

CVE-2021-4155

Remedy

Remedy

Remedy

Never miss a vulnerability like this again

Reference Links

Parent vulnerabilities

Company

Resources

Contact