PT-2025-7967 · Linux+3 · Linux Kernel+3
Baokun Li
+1
·
Published
2022-03-16
·
Updated
2025-05-21
·
CVE-2021-47656
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A use-after-free issue has been identified in the jffs2 file system. The problem occurs when mounting a jffs2 image with abnormal blocks, leading to an error in
jffs2 scan eraseblock(). This error triggers the execution of jffs2 clear xattr subsystem() twice, resulting in a use-after-free condition. The issue is related to the jffs2 clear xattr subsystem() function being called in jffs2 build filesystem() and again in jffs2 do fill super(). The estimated number of potentially affected devices and real-world incidents are not provided.Recommendations
To resolve the issue, move the
jffs2 clear xattr subsystem() function from 'out inohash' to 'out root' to prevent the use-after-free condition.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse