CVE-2021-4155

What it actually does

The XFS_IOC_ALLOCSP IOCTL in the XFS filesystem permits size increases on files with unaligned sizes, exposing otherwise inaccessible data blocks to the calling process.

Why it matters to the business

Local users on affected Linux systems using XFS may obtain sensitive file contents they are not authorized to read, increasing risk of data exposure on servers and workstations that rely on the filesystem.

How an attack unfolds

A local attacker identifies an XFS filesystem, locates files whose sizes are not aligned to filesystem block boundaries, issues the XFS_IOC_ALLOCSP IOCTL to extend the file size, and then reads the newly accessible data blocks that contain residual content from other files.

How to fix it

Upgrade the Linux kernel to the commit 983d8e60f50806f90534cc5373d0ce867e5aaf79 or a later release containing the fix; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Verify the running kernel contains commit 983d8e60f50806f90534cc5373d0ce867e5aaf79 via git log or kernel version string; attempt the IOCTL on a test unaligned file and confirm no data leakage occurs.

Typical attack path

1. Confirm presence of XFS filesystem on the target host
2. Identify candidate files with unaligned sizes via stat or similar calls
3. Invoke XFS_IOC_ALLOCSP IOCTL with crafted parameters to extend file size
4. Read the newly allocated blocks to extract leaked data
5. Repeat or combine with other local access techniques to expand reach

How to detect it

Review audit logs and kernel logs for unusual XFS IOCTL invocations; correlate with file access patterns showing reads beyond expected file boundaries.

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all XFS-using systems
• Limit local user accounts and privileges on multi-user XFS hosts until patched
• Include XFS filesystem integrity checks in regular vulnerability scanning