CVE-2021-47343 (GCVE-0-2021-47343)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2026-08-05 08:47
VLAI
Title
dm btree remove: assign new_root only when removal succeeds
Summary
In the Linux kernel, the following vulnerability has been resolved: dm btree remove: assign new_root only when removal succeeds remove_raw() in dm_btree_remove() may fail due to IO read error (e.g. read the content of origin block fails during shadowing), and the value of shadow_spine::root is uninitialized, but the uninitialized value is still assign to new_root in the end of dm_btree_remove(). For dm-thin, the value of pmd->details_root or pmd->root will become an uninitialized value, so if trying to read details_info tree again out-of-bound memory may occur as showed below: general protection fault, probably for non-canonical address 0x3fdcb14c8d7520 CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6 Hardware name: QEMU Standard PC RIP: 0010:metadata_ll_load_ie+0x14/0x30 Call Trace: sm_metadata_count_is_more_than_one+0xb9/0xe0 dm_tm_shadow_block+0x52/0x1c0 shadow_step+0x59/0xf0 remove_raw+0xb2/0x170 dm_btree_remove+0xf4/0x1c0 dm_pool_delete_thin_device+0xc3/0x140 pool_message+0x218/0x2b0 target_message+0x251/0x290 ctl_ioctl+0x1c4/0x4d0 dm_ctl_ioctl+0xe/0x20 __x64_sys_ioctl+0x7b/0xb0 do_syscall_64+0x40/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixing it by only assign new_root when removal succeeds
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-23 19:04 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < 4c84b3e0728ffe10d89c633694c35a02b5c477dc (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < c154775619186781aaf8a99333ac07437a1768d5 (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < 73f27adaa73e3057a9ec464e33c4f54d34ea5de3 (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < 8fbae4a1bdb5b889490cdee929e68540151536e5 (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < 964d57d1962d7e68f0f578f05d9ae4a104d74851 (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < ba47e65a5de3e0e8270301a409fc63d3129fdb9e (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < 89bf942314b78d454db92427201421b5dec132d9 (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < ad365e9351ac2b450e7e79932ff6abf59342d91a (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < b6e58b5466b2959f83034bead2e2e1395cca8aeb (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 4.4.276 , ≤ 4.4.* (semver)
Unaffected: 4.9.276 , ≤ 4.9.* (semver)
Unaffected: 4.14.240 , ≤ 4.14.* (semver)
Unaffected: 4.19.198 , ≤ 4.19.* (semver)
Unaffected: 5.4.133 , ≤ 5.4.* (semver)
Unaffected: 5.10.51 , ≤ 5.10.* (semver)
Unaffected: 5.12.18 , ≤ 5.12.* (semver)
Unaffected: 5.13.3 , ≤ 5.13.* (semver)
Unaffected: 5.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47343",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T19:04:19.383705Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:19.329Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.519Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c84b3e0728ffe10d89c633694c35a02b5c477dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c154775619186781aaf8a99333ac07437a1768d5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/73f27adaa73e3057a9ec464e33c4f54d34ea5de3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8fbae4a1bdb5b889490cdee929e68540151536e5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/964d57d1962d7e68f0f578f05d9ae4a104d74851"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ba47e65a5de3e0e8270301a409fc63d3129fdb9e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89bf942314b78d454db92427201421b5dec132d9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad365e9351ac2b450e7e79932ff6abf59342d91a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b6e58b5466b2959f83034bead2e2e1395cca8aeb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/persistent-data/dm-btree-remove.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c84b3e0728ffe10d89c633694c35a02b5c477dc",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "c154775619186781aaf8a99333ac07437a1768d5",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "73f27adaa73e3057a9ec464e33c4f54d34ea5de3",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "8fbae4a1bdb5b889490cdee929e68540151536e5",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "964d57d1962d7e68f0f578f05d9ae4a104d74851",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "ba47e65a5de3e0e8270301a409fc63d3129fdb9e",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "89bf942314b78d454db92427201421b5dec132d9",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "ad365e9351ac2b450e7e79932ff6abf59342d91a",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "b6e58b5466b2959f83034bead2e2e1395cca8aeb",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/persistent-data/dm-btree-remove.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.133",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.276",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.276",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.240",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.198",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.133",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.51",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.18",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.3",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm btree remove: assign new_root only when removal succeeds\n\nremove_raw() in dm_btree_remove() may fail due to IO read error\n(e.g. read the content of origin block fails during shadowing),\nand the value of shadow_spine::root is uninitialized, but\nthe uninitialized value is still assign to new_root in the\nend of dm_btree_remove().\n\nFor dm-thin, the value of pmd-\u003edetails_root or pmd-\u003eroot will become\nan uninitialized value, so if trying to read details_info tree again\nout-of-bound memory may occur as showed below:\n\n  general protection fault, probably for non-canonical address 0x3fdcb14c8d7520\n  CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6\n  Hardware name: QEMU Standard PC\n  RIP: 0010:metadata_ll_load_ie+0x14/0x30\n  Call Trace:\n   sm_metadata_count_is_more_than_one+0xb9/0xe0\n   dm_tm_shadow_block+0x52/0x1c0\n   shadow_step+0x59/0xf0\n   remove_raw+0xb2/0x170\n   dm_btree_remove+0xf4/0x1c0\n   dm_pool_delete_thin_device+0xc3/0x140\n   pool_message+0x218/0x2b0\n   target_message+0x251/0x290\n   ctl_ioctl+0x1c4/0x4d0\n   dm_ctl_ioctl+0xe/0x20\n   __x64_sys_ioctl+0x7b/0xb0\n   do_syscall_64+0x40/0xb0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFixing it by only assign new_root when removal succeeds"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through local device-mapper operations\u2014dmsetup ioctls on /dev/mapper/control (pool message \u2192 delete/create) or local block I/O/discard on a dm-thin volume that calls dm_thin_remove_range \u2192 dm_btree_remove\u2014not via network packet processing.\nAC:L - An attacker can reliably force the first shadow_step to fail (leaving spine.root uninitialized) by exhausting metadata space so dm_sm_new_block returns -ENOSPC during discard/remove, or\u2014on the admin path\u2014by placing dm-flakey under the metadata device; neither depends on a race or layout outside attacker influence.\nPR:L - Although the dmsetup path requires capable(CAP_SYS_ADMIN), dm_btree_remove is also reachable from unprivileged discard/write I/O on a thin volume via dm_thin_remove_range/__remove_range with no capability check, which is the common cloud/container deployment of dm-thin.\nUI:N - The attacker issues the discard, writes that fill metadata, or dmsetup delete themselves; no separate victim action such as mounting a crafted filesystem is required.\nS:U - Corruption and the resulting oops remain inside the host kernel\u2019s dm-thin/persistent-data authority and do not cross a VM, IOMMU, or other security boundary.\nC:H - The uninitialized new_root is later used as a metadata block number; at the time of the bug sm_ll_lookup_bitmap had no bounds check, so metadata_ll_load_ie performs an unbounded out-of-bounds read of kernel memory (as the commit\u2019s non-canonical GPF demonstrates), which per guidance scores Confidentiality High.\nI:H - The same unbounded index path exists in metadata_ll_save_ie (OOB write), and installing attacker-influenceable stack garbage as pmd-\u003eroot/details_root causes subsequent btree shadowing/updates to read and write metadata through a corrupted root\u2014memory-corruption integrity impact High under the stated guidance.\nA:H - The documented consequence is a general protection fault / kernel oops when the corrupted root is reused (metadata_ll_load_ie GPF in the commit), which is a complete availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:20.543Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c84b3e0728ffe10d89c633694c35a02b5c477dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/c154775619186781aaf8a99333ac07437a1768d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/73f27adaa73e3057a9ec464e33c4f54d34ea5de3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fbae4a1bdb5b889490cdee929e68540151536e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/964d57d1962d7e68f0f578f05d9ae4a104d74851"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba47e65a5de3e0e8270301a409fc63d3129fdb9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/89bf942314b78d454db92427201421b5dec132d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad365e9351ac2b450e7e79932ff6abf59342d91a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6e58b5466b2959f83034bead2e2e1395cca8aeb"
        }
      ],
      "title": "dm btree remove: assign new_root only when removal succeeds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47343",
    "datePublished": "2024-05-21T14:35:50.293Z",
    "dateReserved": "2024-05-21T14:28:16.979Z",
    "dateUpdated": "2026-08-05T08:47:20.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47343",
      "date": "2026-09-28",
      "epss": "0.00268",
      "percentile": "0.16978"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm btree remove: assign new_root only when removal succeeds\n\nremove_raw() in dm_btree_remove() may fail due to IO read error\n(e.g. read the content of origin block fails during shadowing),\nand the value of shadow_spine::root is uninitialized, but\nthe uninitialized value is still assign to new_root in the\nend of dm_btree_remove().\n\nFor dm-thin, the value of pmd-\u003edetails_root or pmd-\u003eroot will become\nan uninitialized value, so if trying to read details_info tree again\nout-of-bound memory may occur as showed below:\n\n  general protection fault, probably for non-canonical address 0x3fdcb14c8d7520\n  CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6\n  Hardware name: QEMU Standard PC\n  RIP: 0010:metadata_ll_load_ie+0x14/0x30\n  Call Trace:\n   sm_metadata_count_is_more_than_one+0xb9/0xe0\n   dm_tm_shadow_block+0x52/0x1c0\n   shadow_step+0x59/0xf0\n   remove_raw+0xb2/0x170\n   dm_btree_remove+0xf4/0x1c0\n   dm_pool_delete_thin_device+0xc3/0x140\n   pool_message+0x218/0x2b0\n   target_message+0x251/0x290\n   ctl_ioctl+0x1c4/0x4d0\n   dm_ctl_ioctl+0xe/0x20\n   __x64_sys_ioctl+0x7b/0xb0\n   do_syscall_64+0x40/0xb0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFixing it by only assign new_root when removal succeeds"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm btree remove: asigna new_root solo cuando la eliminaci\u00f3n se realiza correctamente. remove_raw() en dm_btree_remove() puede fallar debido a un error de lectura de E/S (por ejemplo, la lectura del contenido del bloque de origen falla durante el sombreado), y el valor de shadow_spine::root no est\u00e1 inicializado, pero el valor no inicializado a\u00fan se asigna a new_root al final de dm_btree_remove(). Para dm-thin, el valor de pmd-\u0026gt;details_root o pmd-\u0026gt;root se convertir\u00e1 en un valor no inicializado, por lo que si intenta leer el \u00e1rbol de detalles_info nuevamente, puede ocurrir que la memoria est\u00e9 fuera de los l\u00edmites, como se muestra a continuaci\u00f3n: falla de protecci\u00f3n general, probablemente para no usuarios. -direcci\u00f3n can\u00f3nica 0x3fdcb14c8d7520 CPU: 4 PID: 515 Comm: dmsetup No contaminado 5.13.0-rc6 Nombre de hardware: QEMU PC est\u00e1ndar RIP: 0010:metadata_ll_load_ie+0x14/0x30 Seguimiento de llamadas: sm_metadata_count_is_more_than_one+0xb9/0xe0 m_shadow_block+0x52/0x1c0 sombra_paso+ 0x59/0xf0 remove_raw+0xb2/0x170 dm_btree_remove+0xf4/0x1c0 dm_pool_delete_thin_device+0xc3/0x140 pool_message+0x218/0x2b0 target_message+0x251/0x290 ctl_ioctl+0x1c4/0x4d0 _ctl_ioctl+0xe/0x20 __x64_sys_ioctl+0x7b/0xb0 do_syscall_64+0x40/0xb0 entrada_SYSCALL_64_after_hwframe+ 0x44/0xae Se soluciona asignando new_root \u00fanicamente cuando la eliminaci\u00f3n se realiza correctamente"
        }
      ],
      "id": "CVE-2021-47343",
      "lastModified": "2024-11-21T06:35:55.597",
      "published": "2024-05-21T15:15:20.993",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/4c84b3e0728ffe10d89c633694c35a02b5c477dc"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/73f27adaa73e3057a9ec464e33c4f54d34ea5de3"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/89bf942314b78d454db92427201421b5dec132d9"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/8fbae4a1bdb5b889490cdee929e68540151536e5"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/964d57d1962d7e68f0f578f05d9ae4a104d74851"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/ad365e9351ac2b450e7e79932ff6abf59342d91a"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/b6e58b5466b2959f83034bead2e2e1395cca8aeb"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/ba47e65a5de3e0e8270301a409fc63d3129fdb9e"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/c154775619186781aaf8a99333ac07437a1768d5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/4c84b3e0728ffe10d89c633694c35a02b5c477dc"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/73f27adaa73e3057a9ec464e33c4f54d34ea5de3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/89bf942314b78d454db92427201421b5dec132d9"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/8fbae4a1bdb5b889490cdee929e68540151536e5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/964d57d1962d7e68f0f578f05d9ae4a104d74851"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/ad365e9351ac2b450e7e79932ff6abf59342d91a"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/b6e58b5466b2959f83034bead2e2e1395cca8aeb"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/ba47e65a5de3e0e8270301a409fc63d3129fdb9e"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/c154775619186781aaf8a99333ac07437a1768d5"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/persistent-data/dm-btree-remove.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4c84b3e0728ffe10d89c633694c35a02b5c477dc",
                    "status": "affected",
                    "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c154775619186781aaf8a99333ac07437a1768d5",
                    "status": "affected",
                    "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "73f27adaa73e3057a9ec464e33c4f54d34ea5de3",
                    "status": "affected",
                    "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8fbae4a1bdb5b889490cdee929e68540151536e5",
                    "status": "affected",
                    "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "964d57d1962d7e68f0f578f05d9ae4a104d74851",
                    "status": "affected",
                    "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ba47e65a5de3e0e8270301a409fc63d3129fdb9e",
                    "status": "affected",
                    "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "89bf942314b78d454db92427201421b5dec132d9",
                    "status": "affected",
                    "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ad365e9351ac2b450e7e79932ff6abf59342d91a",
                    "status": "affected",
                    "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b6e58b5466b2959f83034bead2e2e1395cca8aeb",
                    "status": "affected",
                    "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/persistent-data/dm-btree-remove.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.2"
                  },
                  {
                    "lessThan": "3.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.4.*",
                    "status": "unaffected",
                    "version": "4.4.276",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.276",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.240",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.198",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.133",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.12.*",
                    "status": "unaffected",
                    "version": "5.12.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.13.*",
                    "status": "unaffected",
                    "version": "5.13.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "10282F37-B17F-4974-967E-FCD5ABC9AB8E",
                    "versionEndExcluding": "4.4.276",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C79FFC06-9530-4CD7-B651-01D786CC925E",
                    "versionEndExcluding": "4.9.276",
                    "versionStartIncluding": "4.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FB359B2E-773D-4D52-9915-E07A47ABE72B",
                    "versionEndExcluding": "4.14.240",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B93AEDB9-C52B-4222-8F9A-882DAD9EF5B2",
                    "versionEndExcluding": "4.19.198",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "65A8F1FF-5639-455A-8BF4-9FF529240505",
                    "versionEndExcluding": "5.4.133",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "93289127-DFB3-4515-89DD-50521FF8B7FF",
                    "versionEndExcluding": "5.10.51",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "79D13C82-E06F-4A70-A3D1-C09494FBC94D",
                    "versionEndExcluding": "5.12.18",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "853187F6-707A-487B-95C0-621B5211B43C",
                    "versionEndExcluding": "5.13.3",
                    "versionStartIncluding": "5.13",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm btree remove: assign new_root only when removal succeeds\n\nremove_raw() in dm_btree_remove() may fail due to IO read error\n(e.g. read the content of origin block fails during shadowing),\nand the value of shadow_spine::root is uninitialized, but\nthe uninitialized value is still assign to new_root in the\nend of dm_btree_remove().\n\nFor dm-thin, the value of pmd-\u003edetails_root or pmd-\u003eroot will become\nan uninitialized value, so if trying to read details_info tree again\nout-of-bound memory may occur as showed below:\n\n  general protection fault, probably for non-canonical address 0x3fdcb14c8d7520\n  CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6\n  Hardware name: QEMU Standard PC\n  RIP: 0010:metadata_ll_load_ie+0x14/0x30\n  Call Trace:\n   sm_metadata_count_is_more_than_one+0xb9/0xe0\n   dm_tm_shadow_block+0x52/0x1c0\n   shadow_step+0x59/0xf0\n   remove_raw+0xb2/0x170\n   dm_btree_remove+0xf4/0x1c0\n   dm_pool_delete_thin_device+0xc3/0x140\n   pool_message+0x218/0x2b0\n   target_message+0x251/0x290\n   ctl_ioctl+0x1c4/0x4d0\n   dm_ctl_ioctl+0xe/0x20\n   __x64_sys_ioctl+0x7b/0xb0\n   do_syscall_64+0x40/0xb0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFixing it by only assign new_root when removal succeeds"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm btree remove: asigna new_root solo cuando la eliminaci\u00f3n se realiza correctamente. remove_raw() en dm_btree_remove() puede fallar debido a un error de lectura de E/S (por ejemplo, la lectura del contenido del bloque de origen falla durante el sombreado), y el valor de shadow_spine::root no est\u00e1 inicializado, pero el valor no inicializado a\u00fan se asigna a new_root al final de dm_btree_remove(). Para dm-thin, el valor de pmd-\u0026gt;details_root o pmd-\u0026gt;root se convertir\u00e1 en un valor no inicializado, por lo que si intenta leer el \u00e1rbol de detalles_info nuevamente, puede ocurrir que la memoria est\u00e9 fuera de los l\u00edmites, como se muestra a continuaci\u00f3n: falla de protecci\u00f3n general, probablemente para no usuarios. -direcci\u00f3n can\u00f3nica 0x3fdcb14c8d7520 CPU: 4 PID: 515 Comm: dmsetup No contaminado 5.13.0-rc6 Nombre de hardware: QEMU PC est\u00e1ndar RIP: 0010:metadata_ll_load_ie+0x14/0x30 Seguimiento de llamadas: sm_metadata_count_is_more_than_one+0xb9/0xe0 m_shadow_block+0x52/0x1c0 sombra_paso+ 0x59/0xf0 remove_raw+0xb2/0x170 dm_btree_remove+0xf4/0x1c0 dm_pool_delete_thin_device+0xc3/0x140 pool_message+0x218/0x2b0 target_message+0x251/0x290 ctl_ioctl+0x1c4/0x4d0 _ctl_ioctl+0xe/0x20 __x64_sys_ioctl+0x7b/0xb0 do_syscall_64+0x40/0xb0 entrada_SYSCALL_64_after_hwframe+ 0x44/0xae Se soluciona asignando new_root \u00fanicamente cuando la eliminaci\u00f3n se realiza correctamente"
          }
        ],
        "id": "CVE-2021-47343",
        "lastModified": "2026-08-04T10:16:58.677",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47343",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T19:04:19.383705Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-21T15:15:20.993",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4c84b3e0728ffe10d89c633694c35a02b5c477dc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/73f27adaa73e3057a9ec464e33c4f54d34ea5de3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/89bf942314b78d454db92427201421b5dec132d9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8fbae4a1bdb5b889490cdee929e68540151536e5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/964d57d1962d7e68f0f578f05d9ae4a104d74851"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ad365e9351ac2b450e7e79932ff6abf59342d91a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b6e58b5466b2959f83034bead2e2e1395cca8aeb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ba47e65a5de3e0e8270301a409fc63d3129fdb9e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c154775619186781aaf8a99333ac07437a1768d5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4c84b3e0728ffe10d89c633694c35a02b5c477dc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/73f27adaa73e3057a9ec464e33c4f54d34ea5de3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/89bf942314b78d454db92427201421b5dec132d9"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8fbae4a1bdb5b889490cdee929e68540151536e5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/964d57d1962d7e68f0f578f05d9ae4a104d74851"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ad365e9351ac2b450e7e79932ff6abf59342d91a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b6e58b5466b2959f83034bead2e2e1395cca8aeb"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ba47e65a5de3e0e8270301a409fc63d3129fdb9e"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c154775619186781aaf8a99333ac07437a1768d5"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1188"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:57:58+00:00",
      "cve": "CVE-2021-47343",
      "id": "CVE-2021-47343",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm btree remove: assign new_root only when removal succeeds",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47343.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:45:39Z",
      "cve": "CVE-2021-47343",
      "id": "CVE-2021-47343",
      "initial_release_date": "2024-05-23T15:56:05Z",
      "product_status:known_affected": "536",
      "product_status:known_not_affected": "176",
      "product_status:recommended": "175",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47343",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47343.json",
      "version": "56"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:32:08.519Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4c84b3e0728ffe10d89c633694c35a02b5c477dc"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/c154775619186781aaf8a99333ac07437a1768d5"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/73f27adaa73e3057a9ec464e33c4f54d34ea5de3"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8fbae4a1bdb5b889490cdee929e68540151536e5"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/964d57d1962d7e68f0f578f05d9ae4a104d74851"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ba47e65a5de3e0e8270301a409fc63d3129fdb9e"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/89bf942314b78d454db92427201421b5dec132d9"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ad365e9351ac2b450e7e79932ff6abf59342d91a"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/b6e58b5466b2959f83034bead2e2e1395cca8aeb"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47343",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-23T19:04:19.383705Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:04:26.101Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/md/persistent-data/dm-btree-remove.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "4c84b3e0728ffe10d89c633694c35a02b5c477dc",
                  "status": "affected",
                  "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                  "versionType": "git"
                },
                {
                  "lessThan": "c154775619186781aaf8a99333ac07437a1768d5",
                  "status": "affected",
                  "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                  "versionType": "git"
                },
                {
                  "lessThan": "73f27adaa73e3057a9ec464e33c4f54d34ea5de3",
                  "status": "affected",
                  "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                  "versionType": "git"
                },
                {
                  "lessThan": "8fbae4a1bdb5b889490cdee929e68540151536e5",
                  "status": "affected",
                  "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                  "versionType": "git"
                },
                {
                  "lessThan": "964d57d1962d7e68f0f578f05d9ae4a104d74851",
                  "status": "affected",
                  "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                  "versionType": "git"
                },
                {
                  "lessThan": "ba47e65a5de3e0e8270301a409fc63d3129fdb9e",
                  "status": "affected",
                  "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                  "versionType": "git"
                },
                {
                  "lessThan": "89bf942314b78d454db92427201421b5dec132d9",
                  "status": "affected",
                  "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                  "versionType": "git"
                },
                {
                  "lessThan": "ad365e9351ac2b450e7e79932ff6abf59342d91a",
                  "status": "affected",
                  "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                  "versionType": "git"
                },
                {
                  "lessThan": "b6e58b5466b2959f83034bead2e2e1395cca8aeb",
                  "status": "affected",
                  "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/md/persistent-data/dm-btree-remove.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.2"
                },
                {
                  "lessThan": "3.2",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.4.*",
                  "status": "unaffected",
                  "version": "4.4.276",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.276",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.240",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.198",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.133",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.51",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.12.*",
                  "status": "unaffected",
                  "version": "5.12.18",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.13.*",
                  "status": "unaffected",
                  "version": "5.13.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.14",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.4.276",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.276",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.240",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.198",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.133",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.51",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.18",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13.3",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.14",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm btree remove: assign new_root only when removal succeeds\n\nremove_raw() in dm_btree_remove() may fail due to IO read error\n(e.g. read the content of origin block fails during shadowing),\nand the value of shadow_spine::root is uninitialized, but\nthe uninitialized value is still assign to new_root in the\nend of dm_btree_remove().\n\nFor dm-thin, the value of pmd-\u003edetails_root or pmd-\u003eroot will become\nan uninitialized value, so if trying to read details_info tree again\nout-of-bound memory may occur as showed below:\n\n  general protection fault, probably for non-canonical address 0x3fdcb14c8d7520\n  CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6\n  Hardware name: QEMU Standard PC\n  RIP: 0010:metadata_ll_load_ie+0x14/0x30\n  Call Trace:\n   sm_metadata_count_is_more_than_one+0xb9/0xe0\n   dm_tm_shadow_block+0x52/0x1c0\n   shadow_step+0x59/0xf0\n   remove_raw+0xb2/0x170\n   dm_btree_remove+0xf4/0x1c0\n   dm_pool_delete_thin_device+0xc3/0x140\n   pool_message+0x218/0x2b0\n   target_message+0x251/0x290\n   ctl_ioctl+0x1c4/0x4d0\n   dm_ctl_ioctl+0xe/0x20\n   __x64_sys_ioctl+0x7b/0xb0\n   do_syscall_64+0x40/0xb0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFixing it by only assign new_root when removal succeeds"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable path is reached only through local device-mapper operations\u2014dmsetup ioctls on /dev/mapper/control (pool message \u2192 delete/create) or local block I/O/discard on a dm-thin volume that calls dm_thin_remove_range \u2192 dm_btree_remove\u2014not via network packet processing.\nAC:L - An attacker can reliably force the first shadow_step to fail (leaving spine.root uninitialized) by exhausting metadata space so dm_sm_new_block returns -ENOSPC during discard/remove, or\u2014on the admin path\u2014by placing dm-flakey under the metadata device; neither depends on a race or layout outside attacker influence.\nPR:L - Although the dmsetup path requires capable(CAP_SYS_ADMIN), dm_btree_remove is also reachable from unprivileged discard/write I/O on a thin volume via dm_thin_remove_range/__remove_range with no capability check, which is the common cloud/container deployment of dm-thin.\nUI:N - The attacker issues the discard, writes that fill metadata, or dmsetup delete themselves; no separate victim action such as mounting a crafted filesystem is required.\nS:U - Corruption and the resulting oops remain inside the host kernel\u2019s dm-thin/persistent-data authority and do not cross a VM, IOMMU, or other security boundary.\nC:H - The uninitialized new_root is later used as a metadata block number; at the time of the bug sm_ll_lookup_bitmap had no bounds check, so metadata_ll_load_ie performs an unbounded out-of-bounds read of kernel memory (as the commit\u2019s non-canonical GPF demonstrates), which per guidance scores Confidentiality High.\nI:H - The same unbounded index path exists in metadata_ll_save_ie (OOB write), and installing attacker-influenceable stack garbage as pmd-\u003eroot/details_root causes subsequent btree shadowing/updates to read and write metadata through a corrupted root\u2014memory-corruption integrity impact High under the stated guidance.\nA:H - The documented consequence is a general protection fault / kernel oops when the corrupted root is reused (metadata_ll_load_ie GPF in the commit), which is a complete availability loss."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:47:20.543Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/4c84b3e0728ffe10d89c633694c35a02b5c477dc"
            },
            {
              "url": "https://git.kernel.org/stable/c/c154775619186781aaf8a99333ac07437a1768d5"
            },
            {
              "url": "https://git.kernel.org/stable/c/73f27adaa73e3057a9ec464e33c4f54d34ea5de3"
            },
            {
              "url": "https://git.kernel.org/stable/c/8fbae4a1bdb5b889490cdee929e68540151536e5"
            },
            {
              "url": "https://git.kernel.org/stable/c/964d57d1962d7e68f0f578f05d9ae4a104d74851"
            },
            {
              "url": "https://git.kernel.org/stable/c/ba47e65a5de3e0e8270301a409fc63d3129fdb9e"
            },
            {
              "url": "https://git.kernel.org/stable/c/89bf942314b78d454db92427201421b5dec132d9"
            },
            {
              "url": "https://git.kernel.org/stable/c/ad365e9351ac2b450e7e79932ff6abf59342d91a"
            },
            {
              "url": "https://git.kernel.org/stable/c/b6e58b5466b2959f83034bead2e2e1395cca8aeb"
            }
          ],
          "title": "dm btree remove: assign new_root only when removal succeeds",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47343",
        "datePublished": "2024-05-21T14:35:50.293Z",
        "dateReserved": "2024-05-21T14:28:16.979Z",
        "dateUpdated": "2026-08-05T08:47:20.543Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.