GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47656 (GCVE-0-2021-47656)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2026-08-05 08:48
VLAI
Title
jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
Summary
In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem When we mount a jffs2 image, assume that the first few blocks of the image are normal and contain at least one xattr-related inode, but the next block is abnormal. As a result, an error is returned in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then called in jffs2_build_filesystem() and then again in jffs2_do_fill_super(). Finally we can observe the following report: ================================================================== BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac Read of size 8 at addr ffff8881243384e0 by task mount/719 Call Trace: dump_stack+0x115/0x16b jffs2_clear_xattr_subsystem+0x95/0x6ac jffs2_do_fill_super+0x84f/0xc30 jffs2_fill_super+0x2ea/0x4c0 mtd_get_sb+0x254/0x400 mtd_get_sb_by_nr+0x4f/0xd0 get_tree_mtd+0x498/0x840 jffs2_get_tree+0x25/0x30 vfs_get_tree+0x8d/0x2e0 path_mount+0x50f/0x1e50 do_mount+0x107/0x130 __se_sys_mount+0x1c5/0x2f0 __x64_sys_mount+0xc7/0x160 do_syscall_64+0x45/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 719: kasan_save_stack+0x23/0x60 __kasan_kmalloc.constprop.0+0x10b/0x120 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0x1c0/0x870 jffs2_alloc_xattr_ref+0x2f/0xa0 jffs2_scan_medium.cold+0x3713/0x4794 jffs2_do_mount_fs.cold+0xa7/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] Freed by task 719: kmem_cache_free+0xcc/0x7b0 jffs2_free_xattr_ref+0x78/0x98 jffs2_clear_xattr_subsystem+0xa1/0x6ac jffs2_do_mount_fs.cold+0x5e6/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] The buggy address belongs to the object at ffff8881243384b8 which belongs to the cache jffs2_xattr_ref of size 48 The buggy address is located 40 bytes inside of 48-byte region [ffff8881243384b8, ffff8881243384e8) [...] ================================================================== The triggering of the BUG is shown in the following stack: ----------------------------------------------------------- jffs2_fill_super jffs2_do_fill_super jffs2_do_mount_fs jffs2_build_filesystem jffs2_scan_medium jffs2_scan_eraseblock <--- ERROR jffs2_clear_xattr_subsystem <--- free jffs2_clear_xattr_subsystem <--- free again ----------------------------------------------------------- An error is returned in jffs2_do_mount_fs(). If the error is returned by jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to be executed. If the error is returned by jffs2_build_filesystem(), the jffs2_clear_xattr_subsystem() also does not need to be executed again. So move jffs2_clear_xattr_subsystem() from 'out_inohash' to 'out_root' to fix this UAF problem.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 17:59 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aa98d7cf59b5b0764d3502662053489585faf2fe , < 9150cb625b46f68d524f4cfd491f1aafc23e10a9 (git)
Affected: aa98d7cf59b5b0764d3502662053489585faf2fe , < 3bd2454162ec6bbb5503233c804fce6e4b6dcec5 (git)
Affected: aa98d7cf59b5b0764d3502662053489585faf2fe , < c3b07c875fa8f906f932976460fd14798596f101 (git)
Affected: aa98d7cf59b5b0764d3502662053489585faf2fe , < 30bf7244acf32f19cb722c39f7bc1c2a9f300422 (git)
Affected: aa98d7cf59b5b0764d3502662053489585faf2fe , < 7bb7428dd73991bf4b3a7a61b493ca50046c2b13 (git)
Affected: aa98d7cf59b5b0764d3502662053489585faf2fe , < 7a75740206af5f17e9f3efa384211cba70213da1 (git)
Affected: aa98d7cf59b5b0764d3502662053489585faf2fe , < 22327bd7988f21de3a53c1373f3b81542bfe1f44 (git)
Affected: aa98d7cf59b5b0764d3502662053489585faf2fe , < 8c0f024f29e055840a5a89fe23b96ae3f921afed (git)
Affected: aa98d7cf59b5b0764d3502662053489585faf2fe , < 4c7c44ee1650677fbe89d86edbad9497b7679b5c (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.18
Unaffected: 0 , < 2.6.18 (semver)
Unaffected: 4.9.311 , ≤ 4.9.* (semver)
Unaffected: 4.14.276 , ≤ 4.14.* (semver)
Unaffected: 4.19.238 , ≤ 4.19.* (semver)
Unaffected: 5.4.189 , ≤ 5.4.* (semver)
Unaffected: 5.10.110 , ≤ 5.10.* (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47656",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:59:35.381270Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:30.510Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/jffs2/fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9150cb625b46f68d524f4cfd491f1aafc23e10a9",
              "status": "affected",
              "version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
              "versionType": "git"
            },
            {
              "lessThan": "3bd2454162ec6bbb5503233c804fce6e4b6dcec5",
              "status": "affected",
              "version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
              "versionType": "git"
            },
            {
              "lessThan": "c3b07c875fa8f906f932976460fd14798596f101",
              "status": "affected",
              "version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
              "versionType": "git"
            },
            {
              "lessThan": "30bf7244acf32f19cb722c39f7bc1c2a9f300422",
              "status": "affected",
              "version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
              "versionType": "git"
            },
            {
              "lessThan": "7bb7428dd73991bf4b3a7a61b493ca50046c2b13",
              "status": "affected",
              "version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
              "versionType": "git"
            },
            {
              "lessThan": "7a75740206af5f17e9f3efa384211cba70213da1",
              "status": "affected",
              "version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
              "versionType": "git"
            },
            {
              "lessThan": "22327bd7988f21de3a53c1373f3b81542bfe1f44",
              "status": "affected",
              "version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
              "versionType": "git"
            },
            {
              "lessThan": "8c0f024f29e055840a5a89fe23b96ae3f921afed",
              "status": "affected",
              "version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
              "versionType": "git"
            },
            {
              "lessThan": "4c7c44ee1650677fbe89d86edbad9497b7679b5c",
              "status": "affected",
              "version": "aa98d7cf59b5b0764d3502662053489585faf2fe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/jffs2/fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.311",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.311",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.276",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.238",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.189",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.110",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: fix use-after-free in jffs2_clear_xattr_subsystem\n\nWhen we mount a jffs2 image, assume that the first few blocks of\nthe image are normal and contain at least one xattr-related inode,\nbut the next block is abnormal. As a result, an error is returned\nin jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then\ncalled in jffs2_build_filesystem() and then again in\njffs2_do_fill_super().\n\nFinally we can observe the following report:\n ==================================================================\n BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac\n Read of size 8 at addr ffff8881243384e0 by task mount/719\n\n Call Trace:\n  dump_stack+0x115/0x16b\n  jffs2_clear_xattr_subsystem+0x95/0x6ac\n  jffs2_do_fill_super+0x84f/0xc30\n  jffs2_fill_super+0x2ea/0x4c0\n  mtd_get_sb+0x254/0x400\n  mtd_get_sb_by_nr+0x4f/0xd0\n  get_tree_mtd+0x498/0x840\n  jffs2_get_tree+0x25/0x30\n  vfs_get_tree+0x8d/0x2e0\n  path_mount+0x50f/0x1e50\n  do_mount+0x107/0x130\n  __se_sys_mount+0x1c5/0x2f0\n  __x64_sys_mount+0xc7/0x160\n  do_syscall_64+0x45/0x70\n  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\n Allocated by task 719:\n  kasan_save_stack+0x23/0x60\n  __kasan_kmalloc.constprop.0+0x10b/0x120\n  kasan_slab_alloc+0x12/0x20\n  kmem_cache_alloc+0x1c0/0x870\n  jffs2_alloc_xattr_ref+0x2f/0xa0\n  jffs2_scan_medium.cold+0x3713/0x4794\n  jffs2_do_mount_fs.cold+0xa7/0x2253\n  jffs2_do_fill_super+0x383/0xc30\n  jffs2_fill_super+0x2ea/0x4c0\n [...]\n\n Freed by task 719:\n  kmem_cache_free+0xcc/0x7b0\n  jffs2_free_xattr_ref+0x78/0x98\n  jffs2_clear_xattr_subsystem+0xa1/0x6ac\n  jffs2_do_mount_fs.cold+0x5e6/0x2253\n  jffs2_do_fill_super+0x383/0xc30\n  jffs2_fill_super+0x2ea/0x4c0\n [...]\n\n The buggy address belongs to the object at ffff8881243384b8\n  which belongs to the cache jffs2_xattr_ref of size 48\n The buggy address is located 40 bytes inside of\n  48-byte region [ffff8881243384b8, ffff8881243384e8)\n [...]\n ==================================================================\n\nThe triggering of the BUG is shown in the following stack:\n-----------------------------------------------------------\njffs2_fill_super\n  jffs2_do_fill_super\n    jffs2_do_mount_fs\n      jffs2_build_filesystem\n        jffs2_scan_medium\n          jffs2_scan_eraseblock        \u003c--- ERROR\n        jffs2_clear_xattr_subsystem    \u003c--- free\n    jffs2_clear_xattr_subsystem        \u003c--- free again\n-----------------------------------------------------------\n\nAn error is returned in jffs2_do_mount_fs(). If the error is returned\nby jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to\nbe executed. If the error is returned by jffs2_build_filesystem(), the\njffs2_clear_xattr_subsystem() also does not need to be executed again.\nSo move jffs2_clear_xattr_subsystem() from \u0027out_inohash\u0027 to \u0027out_root\u0027\nto fix this UAF problem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the local mount path (mount \u2192 jffs2_get_tree \u2192 get_tree_mtd \u2192 jffs2_fill_super \u2192 jffs2_do_fill_super \u2192 jffs2_do_mount_fs \u2192 jffs2_build_filesystem), parsing an MTD/JFFS2 image; there is no network-facing consumer.\nAC:L - An attacker who crafts the image fully controls the trigger\u2014place valid XREF/XATTR nodes in early eraseblocks so jffs2_alloc_xattr_ref() populates xref_temp, then make a later block fail jffs2_scan_eraseblock()\u2014with no race or attacker-uncontrollable condition.\nPR:N - The attacker needs no account on the target; they only supply the crafted JFFS2/MTD image (firmware blob, flash/SD contents), and CAP_SYS_ADMIN belongs to the victim or tooling that mounts it, matching the crafted-filesystem-image pattern.\nUI:R - Exploitation requires a victim (root, firmware updater, or automounter) to mount the attacker-supplied JFFS2 image so the failing scan hits the double clear_xattr path.\nS:U - The use-after-free corrupts kernel slab memory within the same host OS security authority; no VM escape, IOMMU bypass, or other cross-boundary compromise occurs.\nC:H - jffs2_clear_xattr_subsystem() frees xref_temp without NULLing it, so the second call reads ref-\u003enext from freed jffs2_xattr_ref slab objects; per guidance a UAF enables arbitrary kernel memory disclosure.\nI:H - The second pass double-frees attacker-populated jffs2_xattr_ref objects, enabling classic heap spraying and overlapping allocations for arbitrary write / control-flow hijack.\nA:H - The KASAN-confirmed use-after-free during mount produces a kernel oops/panic even without full exploitation, and is repeatable on every mount of the crafted image."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:47.063Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101"
        },
        {
          "url": "https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1"
        },
        {
          "url": "https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5c"
        }
      ],
      "title": "jffs2: fix use-after-free in jffs2_clear_xattr_subsystem",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47656",
    "datePublished": "2025-02-26T01:54:20.069Z",
    "dateReserved": "2025-02-26T01:48:21.521Z",
    "dateUpdated": "2026-08-05T08:48:47.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47656",
      "date": "2026-09-17",
      "epss": "0.00253",
      "percentile": "0.17066"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47656\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T06:37:07.360\",\"lastModified\":\"2026-08-04T10:17:12.300\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\njffs2: fix use-after-free in jffs2_clear_xattr_subsystem\\n\\nWhen we mount a jffs2 image, assume that the first few blocks of\\nthe image are normal and contain at least one xattr-related inode,\\nbut the next block is abnormal. As a result, an error is returned\\nin jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then\\ncalled in jffs2_build_filesystem() and then again in\\njffs2_do_fill_super().\\n\\nFinally we can observe the following report:\\n ==================================================================\\n BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac\\n Read of size 8 at addr ffff8881243384e0 by task mount/719\\n\\n Call Trace:\\n  dump_stack+0x115/0x16b\\n  jffs2_clear_xattr_subsystem+0x95/0x6ac\\n  jffs2_do_fill_super+0x84f/0xc30\\n  jffs2_fill_super+0x2ea/0x4c0\\n  mtd_get_sb+0x254/0x400\\n  mtd_get_sb_by_nr+0x4f/0xd0\\n  get_tree_mtd+0x498/0x840\\n  jffs2_get_tree+0x25/0x30\\n  vfs_get_tree+0x8d/0x2e0\\n  path_mount+0x50f/0x1e50\\n  do_mount+0x107/0x130\\n  __se_sys_mount+0x1c5/0x2f0\\n  __x64_sys_mount+0xc7/0x160\\n  do_syscall_64+0x45/0x70\\n  entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\n Allocated by task 719:\\n  kasan_save_stack+0x23/0x60\\n  __kasan_kmalloc.constprop.0+0x10b/0x120\\n  kasan_slab_alloc+0x12/0x20\\n  kmem_cache_alloc+0x1c0/0x870\\n  jffs2_alloc_xattr_ref+0x2f/0xa0\\n  jffs2_scan_medium.cold+0x3713/0x4794\\n  jffs2_do_mount_fs.cold+0xa7/0x2253\\n  jffs2_do_fill_super+0x383/0xc30\\n  jffs2_fill_super+0x2ea/0x4c0\\n [...]\\n\\n Freed by task 719:\\n  kmem_cache_free+0xcc/0x7b0\\n  jffs2_free_xattr_ref+0x78/0x98\\n  jffs2_clear_xattr_subsystem+0xa1/0x6ac\\n  jffs2_do_mount_fs.cold+0x5e6/0x2253\\n  jffs2_do_fill_super+0x383/0xc30\\n  jffs2_fill_super+0x2ea/0x4c0\\n [...]\\n\\n The buggy address belongs to the object at ffff8881243384b8\\n  which belongs to the cache jffs2_xattr_ref of size 48\\n The buggy address is located 40 bytes inside of\\n  48-byte region [ffff8881243384b8, ffff8881243384e8)\\n [...]\\n ==================================================================\\n\\nThe triggering of the BUG is shown in the following stack:\\n-----------------------------------------------------------\\njffs2_fill_super\\n  jffs2_do_fill_super\\n    jffs2_do_mount_fs\\n      jffs2_build_filesystem\\n        jffs2_scan_medium\\n          jffs2_scan_eraseblock        \u003c--- ERROR\\n        jffs2_clear_xattr_subsystem    \u003c--- free\\n    jffs2_clear_xattr_subsystem        \u003c--- free again\\n-----------------------------------------------------------\\n\\nAn error is returned in jffs2_do_mount_fs(). If the error is returned\\nby jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to\\nbe executed. If the error is returned by jffs2_build_filesystem(), the\\njffs2_clear_xattr_subsystem() also does not need to be executed again.\\nSo move jffs2_clear_xattr_subsystem() from \u0027out_inohash\u0027 to \u0027out_root\u0027\\nto fix this UAF problem.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: jffs2: se corrige el use-after-free en jffs2_clear_xattr_subsystem Cuando montamos una imagen jffs2, asumimos que los primeros bloques de la imagen son normales y contienen al menos un inodo relacionado con xattr, pero el siguiente bloque es anormal. Como resultado, se devuelve un error en jffs2_scan_eraseblock(). Luego se llama a jffs2_clear_xattr_subsystem() en jffs2_build_filesystem() y luego nuevamente en jffs2_do_fill_super(). Finalmente podemos observar el siguiente reporte: ======================================================================= ERROR: KASAN: use-after-free en jffs2_clear_xattr_subsystem+0x95/0x6ac Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff8881243384e0 por la tarea mount/719 Rastreo de llamadas: dump_stack+0x115/0x16b jffs2_clear_xattr_subsystem+0x95/0x6ac jffs2_do_fill_super+0x84f/0xc30 jffs2_fill_super+0x2ea/0x4c0 mtd_get_sb+0x254/0x400 mtd_get_sb_by_nr+0x4f/0xd0 get_tree_mtd+0x498/0x840 jffs2_get_tree+0x25/0x30 vfs_get_tree+0x8d/0x2e0 path_mount+0x50f/0x1e50 do_mount+0x107/0x130 __se_sys_mount+0x1c5/0x2f0 __x64_sys_mount+0xc7/0x160 do_syscall_64+0x45/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Asignado por la tarea 719: kasan_save_stack+0x23/0x60 __kasan_kmalloc.constprop.0+0x10b/0x120 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0x1c0/0x870 jffs2_alloc_xattr_ref+0x2f/0xa0 jffs2_scan_medium.cold+0x3713/0x4794 jffs2_do_mount_fs.cold+0xa7/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] Liberado por la tarea 719: kmem_cache_free+0xcc/0x7b0 jffs2_free_xattr_ref+0x78/0x98 jffs2_clear_xattr_subsystem+0xa1/0x6ac jffs2_do_mount_fs.cold+0x5e6/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] La direcci\u00f3n con errores pertenece al objeto en ffff8881243384b8 que pertenece al cach\u00e9 jffs2_xattr_ref de tama\u00f1o 48 La direcci\u00f3n con errores se encuentra 40 bytes dentro de la regi\u00f3n de 48 bytes [ffff8881243384b8, ffff8881243384e8) [...] ========================================================================== La activaci\u00f3n del ERROR se muestra en la siguiente pila: ----------------------------------------------------------- jffs2_fill_super jffs2_do_fill_super jffs2_do_mount_fs jffs2_build_filesystem jffs2_scan_medium jffs2_scan_eraseblock \u0026lt;--- ERROR jffs2_clear_xattr_subsystem \u0026lt;--- free jffs2_clear_xattr_subsystem \u0026lt;--- free again ----------------------------------------------------------- Se devuelve un error en jffs2_do_mount_fs(). Si jffs2_sum_init() devuelve el error, no es necesario ejecutar jffs2_clear_xattr_subsystem(). Si jffs2_build_filesystem() devuelve el error, tampoco es necesario volver a ejecutar jffs2_clear_xattr_subsystem(). Por lo tanto, mueva jffs2_clear_xattr_subsystem() de \u0027out_inohash\u0027 a \u0027out_root\u0027 para solucionar este problema de UAF.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/jffs2/fs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"aa98d7cf59b5b0764d3502662053489585faf2fe\",\"lessThan\":\"9150cb625b46f68d524f4cfd491f1aafc23e10a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa98d7cf59b5b0764d3502662053489585faf2fe\",\"lessThan\":\"3bd2454162ec6bbb5503233c804fce6e4b6dcec5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa98d7cf59b5b0764d3502662053489585faf2fe\",\"lessThan\":\"c3b07c875fa8f906f932976460fd14798596f101\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa98d7cf59b5b0764d3502662053489585faf2fe\",\"lessThan\":\"30bf7244acf32f19cb722c39f7bc1c2a9f300422\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa98d7cf59b5b0764d3502662053489585faf2fe\",\"lessThan\":\"7bb7428dd73991bf4b3a7a61b493ca50046c2b13\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa98d7cf59b5b0764d3502662053489585faf2fe\",\"lessThan\":\"7a75740206af5f17e9f3efa384211cba70213da1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa98d7cf59b5b0764d3502662053489585faf2fe\",\"lessThan\":\"22327bd7988f21de3a53c1373f3b81542bfe1f44\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa98d7cf59b5b0764d3502662053489585faf2fe\",\"lessThan\":\"8c0f024f29e055840a5a89fe23b96ae3f921afed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa98d7cf59b5b0764d3502662053489585faf2fe\",\"lessThan\":\"4c7c44ee1650677fbe89d86edbad9497b7679b5c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/jffs2/fs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.311\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.276\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.238\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.189\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.110\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.33\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.19\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.2\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T17:59:35.381270Z\",\"id\":\"CVE-2021-47656\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.18\",\"versionEndExcluding\":\"4.9.311\",\"matchCriteriaId\":\"EB5E8137-261D-4D1B-A71B-A70EE8FD2C08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.276\",\"matchCriteriaId\":\"6D9B028C-6313-47F9-94B7-5F8122345E49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.238\",\"matchCriteriaId\":\"FA28527A-11D3-41D2-9C4C-ECAC0D6A4A2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.189\",\"matchCriteriaId\":\"8CB6E8F5-C2B1-46F3-A807-0F6104AC340F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.110\",\"matchCriteriaId\":\"91D3BFD0-D3F3-4018-957C-96CCBF357D79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.33\",\"matchCriteriaId\":\"27C42AE8-B387-43E2-938A-E1C8B40BE6D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.2\",\"matchCriteriaId\":\"210C679C-CF84-44A3-8939-E629C87E54BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:53:04+00:00",
      "cve": "CVE-2021-47656",
      "id": "CVE-2021-47656",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47656.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:35:20Z",
      "cve": "CVE-2021-47656",
      "id": "CVE-2021-47656",
      "initial_release_date": "2025-02-27T03:14:07Z",
      "product_status:known_affected": "334",
      "product_status:known_not_affected": "352",
      "product_status:recommended": "223",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47656",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47656.json",
      "version": "38"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47656\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T17:59:35.381270Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T17:59:36.648Z\"}}], \"cna\": {\"title\": \"jffs2: fix use-after-free in jffs2_clear_xattr_subsystem\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only through the local mount path (mount \\u2192 jffs2_get_tree \\u2192 get_tree_mtd \\u2192 jffs2_fill_super \\u2192 jffs2_do_fill_super \\u2192 jffs2_do_mount_fs \\u2192 jffs2_build_filesystem), parsing an MTD/JFFS2 image; there is no network-facing consumer.\\nAC:L - An attacker who crafts the image fully controls the trigger\\u2014place valid XREF/XATTR nodes in early eraseblocks so jffs2_alloc_xattr_ref() populates xref_temp, then make a later block fail jffs2_scan_eraseblock()\\u2014with no race or attacker-uncontrollable condition.\\nPR:N - The attacker needs no account on the target; they only supply the crafted JFFS2/MTD image (firmware blob, flash/SD contents), and CAP_SYS_ADMIN belongs to the victim or tooling that mounts it, matching the crafted-filesystem-image pattern.\\nUI:R - Exploitation requires a victim (root, firmware updater, or automounter) to mount the attacker-supplied JFFS2 image so the failing scan hits the double clear_xattr path.\\nS:U - The use-after-free corrupts kernel slab memory within the same host OS security authority; no VM escape, IOMMU bypass, or other cross-boundary compromise occurs.\\nC:H - jffs2_clear_xattr_subsystem() frees xref_temp without NULLing it, so the second call reads ref-\u003enext from freed jffs2_xattr_ref slab objects; per guidance a UAF enables arbitrary kernel memory disclosure.\\nI:H - The second pass double-frees attacker-populated jffs2_xattr_ref objects, enabling classic heap spraying and overlapping allocations for arbitrary write / control-flow hijack.\\nA:H - The KASAN-confirmed use-after-free during mount produces a kernel oops/panic even without full exploitation, and is repeatable on every mount of the crafted image.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"9150cb625b46f68d524f4cfd491f1aafc23e10a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"3bd2454162ec6bbb5503233c804fce6e4b6dcec5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"c3b07c875fa8f906f932976460fd14798596f101\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"30bf7244acf32f19cb722c39f7bc1c2a9f300422\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"7bb7428dd73991bf4b3a7a61b493ca50046c2b13\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"7a75740206af5f17e9f3efa384211cba70213da1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"22327bd7988f21de3a53c1373f3b81542bfe1f44\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"8c0f024f29e055840a5a89fe23b96ae3f921afed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"aa98d7cf59b5b0764d3502662053489585faf2fe\", \"lessThan\": \"4c7c44ee1650677fbe89d86edbad9497b7679b5c\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/jffs2/fs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.9.311\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.276\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.238\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.189\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.110\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/jffs2/fs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9150cb625b46f68d524f4cfd491f1aafc23e10a9\"}, {\"url\": \"https://git.kernel.org/stable/c/3bd2454162ec6bbb5503233c804fce6e4b6dcec5\"}, {\"url\": \"https://git.kernel.org/stable/c/c3b07c875fa8f906f932976460fd14798596f101\"}, {\"url\": \"https://git.kernel.org/stable/c/30bf7244acf32f19cb722c39f7bc1c2a9f300422\"}, {\"url\": \"https://git.kernel.org/stable/c/7bb7428dd73991bf4b3a7a61b493ca50046c2b13\"}, {\"url\": \"https://git.kernel.org/stable/c/7a75740206af5f17e9f3efa384211cba70213da1\"}, {\"url\": \"https://git.kernel.org/stable/c/22327bd7988f21de3a53c1373f3b81542bfe1f44\"}, {\"url\": \"https://git.kernel.org/stable/c/8c0f024f29e055840a5a89fe23b96ae3f921afed\"}, {\"url\": \"https://git.kernel.org/stable/c/4c7c44ee1650677fbe89d86edbad9497b7679b5c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\njffs2: fix use-after-free in jffs2_clear_xattr_subsystem\\n\\nWhen we mount a jffs2 image, assume that the first few blocks of\\nthe image are normal and contain at least one xattr-related inode,\\nbut the next block is abnormal. As a result, an error is returned\\nin jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then\\ncalled in jffs2_build_filesystem() and then again in\\njffs2_do_fill_super().\\n\\nFinally we can observe the following report:\\n ==================================================================\\n BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac\\n Read of size 8 at addr ffff8881243384e0 by task mount/719\\n\\n Call Trace:\\n  dump_stack+0x115/0x16b\\n  jffs2_clear_xattr_subsystem+0x95/0x6ac\\n  jffs2_do_fill_super+0x84f/0xc30\\n  jffs2_fill_super+0x2ea/0x4c0\\n  mtd_get_sb+0x254/0x400\\n  mtd_get_sb_by_nr+0x4f/0xd0\\n  get_tree_mtd+0x498/0x840\\n  jffs2_get_tree+0x25/0x30\\n  vfs_get_tree+0x8d/0x2e0\\n  path_mount+0x50f/0x1e50\\n  do_mount+0x107/0x130\\n  __se_sys_mount+0x1c5/0x2f0\\n  __x64_sys_mount+0xc7/0x160\\n  do_syscall_64+0x45/0x70\\n  entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\n Allocated by task 719:\\n  kasan_save_stack+0x23/0x60\\n  __kasan_kmalloc.constprop.0+0x10b/0x120\\n  kasan_slab_alloc+0x12/0x20\\n  kmem_cache_alloc+0x1c0/0x870\\n  jffs2_alloc_xattr_ref+0x2f/0xa0\\n  jffs2_scan_medium.cold+0x3713/0x4794\\n  jffs2_do_mount_fs.cold+0xa7/0x2253\\n  jffs2_do_fill_super+0x383/0xc30\\n  jffs2_fill_super+0x2ea/0x4c0\\n [...]\\n\\n Freed by task 719:\\n  kmem_cache_free+0xcc/0x7b0\\n  jffs2_free_xattr_ref+0x78/0x98\\n  jffs2_clear_xattr_subsystem+0xa1/0x6ac\\n  jffs2_do_mount_fs.cold+0x5e6/0x2253\\n  jffs2_do_fill_super+0x383/0xc30\\n  jffs2_fill_super+0x2ea/0x4c0\\n [...]\\n\\n The buggy address belongs to the object at ffff8881243384b8\\n  which belongs to the cache jffs2_xattr_ref of size 48\\n The buggy address is located 40 bytes inside of\\n  48-byte region [ffff8881243384b8, ffff8881243384e8)\\n [...]\\n ==================================================================\\n\\nThe triggering of the BUG is shown in the following stack:\\n-----------------------------------------------------------\\njffs2_fill_super\\n  jffs2_do_fill_super\\n    jffs2_do_mount_fs\\n      jffs2_build_filesystem\\n        jffs2_scan_medium\\n          jffs2_scan_eraseblock        \u003c--- ERROR\\n        jffs2_clear_xattr_subsystem    \u003c--- free\\n    jffs2_clear_xattr_subsystem        \u003c--- free again\\n-----------------------------------------------------------\\n\\nAn error is returned in jffs2_do_mount_fs(). If the error is returned\\nby jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to\\nbe executed. If the error is returned by jffs2_build_filesystem(), the\\njffs2_clear_xattr_subsystem() also does not need to be executed again.\\nSo move jffs2_clear_xattr_subsystem() from \u0027out_inohash\u0027 to \u0027out_root\u0027\\nto fix this UAF problem.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.311\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.276\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.238\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.189\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.110\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.33\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.19\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.2\", \"versionStartIncluding\": \"2.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"2.6.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:47.063Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47656\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:47.063Z\", \"dateReserved\": \"2025-02-26T01:48:21.521Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:54:20.069Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.