CVE-2021-47114

What it actually does

Race condition in ocfs2 fallocate handling allows pages beyond the original inode size to be dropped during writeback when punch-hole and size-extension operations interleave with buffer writes and ocfs2_writepage, resulting in zeroed or missing data blocks.

Why it matters to the business

File corruption can occur during routine operations such as virtual-disk conversion or resizing on ocfs2 filesystems, leading to data loss, failed image conversions, and the need for restores or reprocessing in environments that depend on those files.

How an attack unfolds

An unprivileged process or tool invokes fallocate with FALLOC_FL_PUNCH_HOLE beyond current inode size followed immediately by a size-extending fallocate; if writeback flushes the inode before the new size is committed, ocfs2_writepage discards the trailing pages, permanently corrupting the file. The pattern is reproducible with qemu-img convert on affected kernels.

How to fix it

Upgrade libgit2 and libgit2-devel packages to 0.26.8-2.el8 or later on AlmaLinux 8 systems; apply the upstream ocfs2 fix that zeros EOF blocks on inode extension; reboot or restart affected services after the update.

How to confirm the fix worked

Confirm installed package versions match the fixed releases; re-run the qemu-img convert reproducer on an ocfs2-backed image and verify the resulting file matches the source; inspect kernel logs for ocfs2_writepage warnings on patched systems.

Typical attack path

1. Call fallocate(FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE) with offset beyond current inode size
2. Immediately follow with fallocate(0) to extend the inode size
3. Trigger writeback (e.g., via sync or memory pressure) before the new isize is visible
4. ocfs2_writepage drops pages past the old isize, causing data loss

How to detect it

Review system logs for ocfs2_writepage and fallocate activity around the time of file corruption reports; correlate with qemu-img or similar tools performing hole-punch operations on ocfs2 mounts; compare file checksums before and after conversion workflows.

What your security team should do

• Apply the libgit2 package update immediately on all AlmaLinux 8 hosts using ocfs2
• Scan for and replace any corrupted virtual-machine or container images produced by qemu-img on ocfs2
• Add package-version checks to CI/CD pipelines that build or convert disk images
• Monitor EPSS and kernel changelogs for related ocfs2 fixes in future releases