CVE-2021-47351: ubifs: Fix races between xattr_{set|get} and listxattr operations

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-21 · updated 2026-08-04
Weakness: CWE-617

Description

In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix races between xattr_{set|get} and listxattr operations UBIFS may occur some problems with concurrent xattr_{set|get} and listxattr operations, such as assertion failure, memory corruption, stale xattr value[1]. Fix it by importing a new rw-lock in @ubifs_inode to serilize write operations on xattr, concurrent read operations are still effective, just like ext4. [1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com

Affected products

Linux kernel: from 2.6.27 before 5.4.133; from 5.5 before 5.10.51; from 5.11 before 5.12.18; from 5.13 before 5.13.3 — fixed in 5.10.51, 5.12.18, 5.13.3, 5.4.133

How to fix

Upgrade to a fixed version: Linux kernel 5.10.51, 5.12.18, 5.13.3, 5.4.133. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47351 or the next vulnerability affects your stack