CVE-2021-47256
Linux Kernel - ext4 Page Writeback Memory Failure
Description
In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: make sure wait for page writeback in memory_failure Our syzkaller trigger the "BUG_ON(!list_empty(&inode->i_wb_list))" in clear_inode: kernel BUG at fs/inode.c:519! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: Process syz-executor.0 (pid: 249, stack limit = 0x00000000a12409d7) CPU: 1 PID: 249 Comm: syz-executor.0 Not tainted 4.19.95 Hardware name: linux,dummy-virt (DT) pstate: 80000005 (Nzcv daif -PAN -UAO) pc : clear_inode+0x280/0x2a8 lr : clear_inode+0x280/0x2a8 Call trace: clear_inode+0x280/0x2a8 ext4_clear_inode+0x38/0xe8 ext4_free_inode+0x130/0xc68 ext4_evict_inode+0xb20/0xcb8 evict+0x1a8/0x3c0 iput+0x344/0x460 do_unlinkat+0x260/0x410 __arm64_sys_unlinkat+0x6c/0xc0 el0_svc_common+0xdc/0x3b0 el0_svc_handler+0xf8/0x160 el0_svc+0x10/0x218 Kernel panic - not syncing: Fatal exception A crash dump of this problem show that someone called __munlock_pagevec to clear page LRU without lock_page: do_mmap -> mmap_region -> do_munmap -> munlock_vma_pages_range -> __munlock_pagevec. As a result memory_failure will call identify_page_state without wait_on_page_writeback. And after truncate_error_page clear the mapping of this page. end_page_writeback won't call sb_clear_inode_writeback to clear inode->i_wb_list. That will trigger BUG_ON in clear_inode! Fix it by checking PageWriteback too to help determine should we skip wait_on_page_writeback.
INFO
Published Date :
May 21, 2024, 3:15 p.m.
Last Modified :
April 30, 2025, 3:05 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2021-47256.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2021-47256 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2021-47256 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Apr. 30, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.16 up to (excluding) 4.14.238 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 up to (excluding) 4.19.196 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.128 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.46 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.12.13 Added Reference Type CVE: https://git.kernel.org/stable/c/28788dc5c70597395b6b451dae4549bbaa8e2c56 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/28788dc5c70597395b6b451dae4549bbaa8e2c56 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/566345aaabac853aa866f53a219c4b02a6beb527 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/566345aaabac853aa866f53a219c4b02a6beb527 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/6d210d547adc2218ef8b5bcf23518c5f2f1fd872 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6d210d547adc2218ef8b5bcf23518c5f2f1fd872 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/9e379da727a7a031be9b877cde7b9c34a0fb8306 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9e379da727a7a031be9b877cde7b9c34a0fb8306 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/d05267fd27a5c4f54e06daefa3035995d765ca0c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d05267fd27a5c4f54e06daefa3035995d765ca0c Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/e8675d291ac007e1c636870db880f837a9ea112a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e8675d291ac007e1c636870db880f837a9ea112a Types: Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/28788dc5c70597395b6b451dae4549bbaa8e2c56 Added Reference https://git.kernel.org/stable/c/566345aaabac853aa866f53a219c4b02a6beb527 Added Reference https://git.kernel.org/stable/c/6d210d547adc2218ef8b5bcf23518c5f2f1fd872 Added Reference https://git.kernel.org/stable/c/9e379da727a7a031be9b877cde7b9c34a0fb8306 Added Reference https://git.kernel.org/stable/c/d05267fd27a5c4f54e06daefa3035995d765ca0c Added Reference https://git.kernel.org/stable/c/e8675d291ac007e1c636870db880f837a9ea112a -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 28, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 21, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: make sure wait for page writeback in memory_failure Our syzkaller trigger the "BUG_ON(!list_empty(&inode->i_wb_list))" in clear_inode: kernel BUG at fs/inode.c:519! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: Process syz-executor.0 (pid: 249, stack limit = 0x00000000a12409d7) CPU: 1 PID: 249 Comm: syz-executor.0 Not tainted 4.19.95 Hardware name: linux,dummy-virt (DT) pstate: 80000005 (Nzcv daif -PAN -UAO) pc : clear_inode+0x280/0x2a8 lr : clear_inode+0x280/0x2a8 Call trace: clear_inode+0x280/0x2a8 ext4_clear_inode+0x38/0xe8 ext4_free_inode+0x130/0xc68 ext4_evict_inode+0xb20/0xcb8 evict+0x1a8/0x3c0 iput+0x344/0x460 do_unlinkat+0x260/0x410 __arm64_sys_unlinkat+0x6c/0xc0 el0_svc_common+0xdc/0x3b0 el0_svc_handler+0xf8/0x160 el0_svc+0x10/0x218 Kernel panic - not syncing: Fatal exception A crash dump of this problem show that someone called __munlock_pagevec to clear page LRU without lock_page: do_mmap -> mmap_region -> do_munmap -> munlock_vma_pages_range -> __munlock_pagevec. As a result memory_failure will call identify_page_state without wait_on_page_writeback. And after truncate_error_page clear the mapping of this page. end_page_writeback won't call sb_clear_inode_writeback to clear inode->i_wb_list. That will trigger BUG_ON in clear_inode! Fix it by checking PageWriteback too to help determine should we skip wait_on_page_writeback. Added Reference kernel.org https://git.kernel.org/stable/c/d05267fd27a5c4f54e06daefa3035995d765ca0c [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/6d210d547adc2218ef8b5bcf23518c5f2f1fd872 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/566345aaabac853aa866f53a219c4b02a6beb527 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/9e379da727a7a031be9b877cde7b9c34a0fb8306 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/28788dc5c70597395b6b451dae4549bbaa8e2c56 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/e8675d291ac007e1c636870db880f837a9ea112a [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2021-47256 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2021-47256
weaknesses.