CVE-2021-47366 (GCVE-0-2021-47366)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:03 – Updated: 2025-05-04 07:09
VLAI?
Title
afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
Summary
In the Linux kernel, the following vulnerability has been resolved: afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server AFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and Linux's afs client switches between them when talking to a non-YFS server if the read size, the file position or the sum of the two have the upper 32 bits set of the 64-bit value. This is a problem, however, since the file position and length fields of FS.FetchData are *signed* 32-bit values. Fix this by capturing the capability bits obtained from the fileserver when it's sent an FS.GetCapabilities RPC, rather than just discarding them, and then picking out the VICED_CAPABILITY_64BITFILES flag. This can then be used to decide whether to use FS.FetchData or FS.FetchData64 - and also FS.StoreData or FS.StoreData64 - rather than using upper_32_bits() to switch on the parameter values. This capabilities flag could also be used to limit the maximum size of the file, but all servers must be checked for that. Note that the issue does not exist with FS.StoreData - that uses *unsigned* 32-bit values. It's also not a problem with Auristor servers as its YFS.FetchData64 op uses unsigned 64-bit values. This can be tested by cloning a git repo through an OpenAFS client to an OpenAFS server and then doing "git status" on it from a Linux afs client[1]. Provided the clone has a pack file that's in the 2G-4G range, the git status will show errors like: error: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index error: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index This can be observed in the server's FileLog with something like the following appearing: Sun Aug 29 19:31:39 2021 SRXAFS_FetchData, Fid = 2303380852.491776.3263114, Host 192.168.11.201:7001, Id 1001 Sun Aug 29 19:31:39 2021 CheckRights: len=0, for host=192.168.11.201:7001 Sun Aug 29 19:31:39 2021 FetchData_RXStyle: Pos 18446744071815340032, Len 3154 Sun Aug 29 19:31:39 2021 FetchData_RXStyle: file size 2400758866 ... Sun Aug 29 19:31:40 2021 SRXAFS_FetchData returns 5 Note the file position of 18446744071815340032. This is the requested file position sign-extended.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b9b1f8d5930a813879278d0cbfc8c658d6a038dc , < e66fc460d6dcf85cf12288e133a081205aebcd97 (git)
Affected: b9b1f8d5930a813879278d0cbfc8c658d6a038dc , < b537a3c21775075395af475dcc6ef212fcf29db8 (git)
Create a notification for this product.
    Linux Linux Affected: 2.6.22
Unaffected: 0 , < 2.6.22 (semver)
Unaffected: 5.14.9 , ≤ 5.14.* (semver)
Unaffected: 5.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47366",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:37:26.717348Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:38:20.276Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.615Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e66fc460d6dcf85cf12288e133a081205aebcd97"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b537a3c21775075395af475dcc6ef212fcf29db8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/afs/fs_probe.c",
            "fs/afs/fsclient.c",
            "fs/afs/internal.h",
            "fs/afs/protocol_afs.h",
            "fs/afs/protocol_yfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e66fc460d6dcf85cf12288e133a081205aebcd97",
              "status": "affected",
              "version": "b9b1f8d5930a813879278d0cbfc8c658d6a038dc",
              "versionType": "git"
            },
            {
              "lessThan": "b537a3c21775075395af475dcc6ef212fcf29db8",
              "status": "affected",
              "version": "b9b1f8d5930a813879278d0cbfc8c658d6a038dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/afs/fs_probe.c",
            "fs/afs/fsclient.c",
            "fs/afs/internal.h",
            "fs/afs/protocol_afs.h",
            "fs/afs/protocol_yfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.22"
            },
            {
              "lessThan": "2.6.22",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.9",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server\n\nAFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and\nLinux\u0027s afs client switches between them when talking to a non-YFS server\nif the read size, the file position or the sum of the two have the upper 32\nbits set of the 64-bit value.\n\nThis is a problem, however, since the file position and length fields of\nFS.FetchData are *signed* 32-bit values.\n\nFix this by capturing the capability bits obtained from the fileserver when\nit\u0027s sent an FS.GetCapabilities RPC, rather than just discarding them, and\nthen picking out the VICED_CAPABILITY_64BITFILES flag.  This can then be\nused to decide whether to use FS.FetchData or FS.FetchData64 - and also\nFS.StoreData or FS.StoreData64 - rather than using upper_32_bits() to\nswitch on the parameter values.\n\nThis capabilities flag could also be used to limit the maximum size of the\nfile, but all servers must be checked for that.\n\nNote that the issue does not exist with FS.StoreData - that uses *unsigned*\n32-bit values.  It\u0027s also not a problem with Auristor servers as its\nYFS.FetchData64 op uses unsigned 64-bit values.\n\nThis can be tested by cloning a git repo through an OpenAFS client to an\nOpenAFS server and then doing \"git status\" on it from a Linux afs\nclient[1].  Provided the clone has a pack file that\u0027s in the 2G-4G range,\nthe git status will show errors like:\n\n\terror: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index\n\terror: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index\n\nThis can be observed in the server\u0027s FileLog with something like the\nfollowing appearing:\n\nSun Aug 29 19:31:39 2021 SRXAFS_FetchData, Fid = 2303380852.491776.3263114, Host 192.168.11.201:7001, Id 1001\nSun Aug 29 19:31:39 2021 CheckRights: len=0, for host=192.168.11.201:7001\nSun Aug 29 19:31:39 2021 FetchData_RXStyle: Pos 18446744071815340032, Len 3154\nSun Aug 29 19:31:39 2021 FetchData_RXStyle: file size 2400758866\n...\nSun Aug 29 19:31:40 2021 SRXAFS_FetchData returns 5\n\nNote the file position of 18446744071815340032.  This is the requested file\nposition sign-extended."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:09:27.646Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e66fc460d6dcf85cf12288e133a081205aebcd97"
        },
        {
          "url": "https://git.kernel.org/stable/c/b537a3c21775075395af475dcc6ef212fcf29db8"
        }
      ],
      "title": "afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47366",
    "datePublished": "2024-05-21T15:03:33.176Z",
    "dateReserved": "2024-05-21T14:58:30.810Z",
    "dateUpdated": "2025-05-04T07:09:27.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e66fc460d6dcf85cf12288e133a081205aebcd97\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b537a3c21775075395af475dcc6ef212fcf29db8\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.615Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47366\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T17:37:26.717348Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T17:37:27.786Z\"}}], \"cna\": {\"title\": \"afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b9b1f8d5930a813879278d0cbfc8c658d6a038dc\", \"lessThan\": \"e66fc460d6dcf85cf12288e133a081205aebcd97\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b9b1f8d5930a813879278d0cbfc8c658d6a038dc\", \"lessThan\": \"b537a3c21775075395af475dcc6ef212fcf29db8\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/afs/fs_probe.c\", \"fs/afs/fsclient.c\", \"fs/afs/internal.h\", \"fs/afs/protocol_afs.h\", \"fs/afs/protocol_yfs.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.22\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.22\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.14.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/afs/fs_probe.c\", \"fs/afs/fsclient.c\", \"fs/afs/internal.h\", \"fs/afs/protocol_afs.h\", \"fs/afs/protocol_yfs.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e66fc460d6dcf85cf12288e133a081205aebcd97\"}, {\"url\": \"https://git.kernel.org/stable/c/b537a3c21775075395af475dcc6ef212fcf29db8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nafs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server\\n\\nAFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and\\nLinux\u0027s afs client switches between them when talking to a non-YFS server\\nif the read size, the file position or the sum of the two have the upper 32\\nbits set of the 64-bit value.\\n\\nThis is a problem, however, since the file position and length fields of\\nFS.FetchData are *signed* 32-bit values.\\n\\nFix this by capturing the capability bits obtained from the fileserver when\\nit\u0027s sent an FS.GetCapabilities RPC, rather than just discarding them, and\\nthen picking out the VICED_CAPABILITY_64BITFILES flag.  This can then be\\nused to decide whether to use FS.FetchData or FS.FetchData64 - and also\\nFS.StoreData or FS.StoreData64 - rather than using upper_32_bits() to\\nswitch on the parameter values.\\n\\nThis capabilities flag could also be used to limit the maximum size of the\\nfile, but all servers must be checked for that.\\n\\nNote that the issue does not exist with FS.StoreData - that uses *unsigned*\\n32-bit values.  It\u0027s also not a problem with Auristor servers as its\\nYFS.FetchData64 op uses unsigned 64-bit values.\\n\\nThis can be tested by cloning a git repo through an OpenAFS client to an\\nOpenAFS server and then doing \\\"git status\\\" on it from a Linux afs\\nclient[1].  Provided the clone has a pack file that\u0027s in the 2G-4G range,\\nthe git status will show errors like:\\n\\n\\terror: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index\\n\\terror: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index\\n\\nThis can be observed in the server\u0027s FileLog with something like the\\nfollowing appearing:\\n\\nSun Aug 29 19:31:39 2021 SRXAFS_FetchData, Fid = 2303380852.491776.3263114, Host 192.168.11.201:7001, Id 1001\\nSun Aug 29 19:31:39 2021 CheckRights: len=0, for host=192.168.11.201:7001\\nSun Aug 29 19:31:39 2021 FetchData_RXStyle: Pos 18446744071815340032, Len 3154\\nSun Aug 29 19:31:39 2021 FetchData_RXStyle: file size 2400758866\\n...\\nSun Aug 29 19:31:40 2021 SRXAFS_FetchData returns 5\\n\\nNote the file position of 18446744071815340032.  This is the requested file\\nposition sign-extended.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.9\", \"versionStartIncluding\": \"2.6.22\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"2.6.22\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:09:27.646Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47366\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:09:27.646Z\", \"dateReserved\": \"2024-05-21T14:58:30.810Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:03:33.176Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.