Critical Btrfs Device Name Disclosure in Linux Kernel - CVE-2021-47599
Summary
CVE-2021-47599: In the Linux kernel, the following vulnerability has been resolved: btrfs: use latest_dev in btrfs_show_devname The test case btrfs/238 reports the warning below: WARNING: CPU: 3 PID: 481 at fs/btrfs/super.c:2509 btrfs_s... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system operations. The Btrfs (B-tree file system) is a modern file system for Linux that offers advanced features like snapshots, dynamic inode allocation, and built-in RAID capabilities. However, it is susceptible to vulnerabilities that can lead to system instability or data exposure, such as the one identified in CVE-2021-47599.
Vulnerability Detail
CVE-2021-47599 is a vulnerability in the Btrfs file system implementation within the Linux kernel. It arises when the function btrfs_show_devname attempts to access device names after the devices have been moved to a different list during the btrfs_prepare_sprout() operation. This results in a warning being triggered, indicating that no devices were found. The potential ramifications include system warnings and possible confusion during system operations, although it does not directly lead to data corruption or unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the kernel update as described in the 'how_to_fix' section.
Conclusion
CVE-2021-47599 is a notable vulnerability in the Linux kernel's Btrfs file system that can lead to misleading warnings during system operations. It is crucial for users to update their kernels to the fixed versions to ensure system stability and avoid confusion. Monitoring tools like Vulert can assist in keeping track of such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47599 is a vulnerability in the Linux kernel's Btrfs file system that can cause warnings related to device names when certain operations are performed.
While it does not lead to data corruption or unauthorized access, it can cause system warnings that may confuse administrators during system operations.
You should upgrade your Linux kernel to at least version 5.15.15-1 to mitigate this vulnerability.
Yes, you can use tools like Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
