Critical Vulnerability in Linux Kernel AFS Client: FS.FetchData Corruption
Summary
CVE-2021-47366: In the Linux kernel, the following vulnerability has been resolved: afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server AFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and Linux's af... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and managing hardware resources. The AFS (Andrew File System) client allows for efficient file sharing and management across distributed systems. This vulnerability affects the AFS client when interacting with non-YFS servers, specifically during data fetch operations, leading to potential data corruption.
Vulnerability Detail
The vulnerability arises from the AFS client's handling of file position and length fields in the FS.FetchData RPC. These fields are signed 32-bit values, which can lead to corruption when the upper 32 bits of a 64-bit value are set. This issue can cause incorrect file positions to be requested, resulting in data corruption during read operations. The problem is particularly evident when file sizes fall within the 2G-4G range, leading to errors during operations like 'git status' on cloned repositories.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the AFS client for operations involving files larger than 2G until the kernel is updated. Alternatively, consider using Auristor servers, which do not exhibit this issue due to their use of unsigned 64-bit values in the YFS.FetchData64 operation.
Conclusion
The vulnerability in the Linux kernel's AFS client poses a significant risk of data corruption during file operations. By updating to the latest kernel version, users can mitigate this risk effectively. Temporary workarounds are available, but a permanent fix is recommended for long-term stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to data corruption when reading files from an OpenAFS server, particularly for files in the 2G-4G range.
You can check your system's kernel version and see if it is below 5.14.9-1 for Debian 12 and 13, or apply the latest updates for Debian 11.
Symptoms include errors during file operations, such as 'git status', indicating that packfiles do not match the index.
Yes, updating the Linux kernel to the specified versions will permanently fix the vulnerability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
