PT-2024-11063 · Linux · Linux Kernel

Ye Bin · Published 2021-04-09 · Updated 2024-04-10 · CVE-2021-46945

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the commit 014c9caa29d3

Description The issue is related to the ext4 file system in the Linux kernel. Before commit 014c9caa29d3, a series of commands could trigger a panic. The commands include mounting a file system with the "errors=panic" option and then remounting it with the "abort" option. After the commit, remounting with the "abort" option no longer triggers a panic. However, this change also introduces a new behavior where a different series of commands will cause a panic, which previously did not. The commands that now cause a panic include mounting with "errors=panic" and then writing to a specific file system trigger. This change makes the ext4 behavior more consistent.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the commit 014c9caa29d3 or later. As a temporary workaround, consider avoiding the use of the "errors=panic" and "abort" mount options together until a patch is available. Restrict access to the file system trigger to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-02869

CVE-2021-46945

Affected Products

Linux Kernel

References · 18

• https://git.kernel.org/stable/c/1e9ea8f4637026b8e965128953f2da061ccae9c4 · Patch
• https://ubuntu.com/security/CVE-2021-46945 · Vendor Advisory
• https://git.kernel.org/stable/c/ac2f7ca51b0929461ea49918f27c11b680f28995 · Patch
• https://git.kernel.org/stable/c/64e1eebe2131183174f4fbb6b1491355f96c6cde · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-46945 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46945 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46945 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-46945 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02869 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-46945 · Security Note
• https://lore.kernel.org/linux-cve-announce/[e-mail]/T/#u · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46945 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.3 · Note
• https://twitter.com/CVEnew/status/1762551321851269346 · Twitter Post
• https://lore.kernel.org/linux-cve-announce/[e-mail] · Note