CVE-2021-47458: ocfs2: mount fails with buffer overflow in strlen
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: mount fails with buffer overflow in strlen
Starting with kernel 5.11 built with CONFIGFORTIFYSOURCE mouting an ocfs2 filesystem with either o2cb or pcmk cluster stack fails with the trace below. Problem seems to be that strings for cluster stack and cluster name are not guaranteed to be null terminated in the disk representation, while strlcpy assumes that the source string is always null terminated. This causes a read outside of the source string triggering the buffer overflow detection.
detected buffer overflow in strlen ------------[ cut here ]------------ kernel BUG at lib/string.c:1149! invalid opcode: 0000 [#1] SMP PTI CPU: 1 PID: 910 Comm: mount.ocfs2 Not tainted 5.14.0-1-amd64 #1 Debian 5.14.6-2 RIP: 0010:fortifypanic+0xf/0x11 ... Call Trace: ocfs2initializesuper.isra.0.cold+0xc/0x18 [ocfs2] ocfs2fillsuper+0x359/0x19b0 [ocfs2] mountbdev+0x185/0x1b0 legacygettree+0x27/0x40 vfsgettree+0x25/0xb0 pathmount+0x454/0xa20 x64sysmount+0x103/0x140 dosyscall64+0x3b/0xc0 entrySYSCALL64afterhwframe+0x44/0xae
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.14.6-2 - Compensating control
If OCFS2 mounts fail with a buffer overflow in strlen due to non-null-terminated cluster stack strings, temporarily avoid mounting the affected OCFS2 filesystem (e.g., delay/stop OCFS2 mounts) until the kernel fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47458?
CVE-2021-47458 is classified as a high severity vulnerability due to its potential for a buffer overflow leading to a denial of service.
How do I fix CVE-2021-47458?
To mitigate CVE-2021-47458, users should upgrade to a Linux kernel version later than 5.11 where the vulnerability has been resolved.
What systems are affected by CVE-2021-47458?
CVE-2021-47458 affects systems running the Linux kernel version 5.11 or older that are configured with CONFIG_FORTIFY_SOURCE.
What can happen if CVE-2021-47458 is exploited?
Exploitation of CVE-2021-47458 may lead to a crash of the Linux kernel or a denial of service when mounting an ocfs2 filesystem.
Is there a workaround for CVE-2021-47458?
Currently, the recommended mitigation for CVE-2021-47458 is to upgrade the Linux kernel to a version that includes the necessary patches.