CVE-2021-47340

What it actually does

Null pointer dereference in JFS diFree when JFS_SBI(inode->i_sb)->ipimap is NULL, causing JFS_IP to return an invalid pointer and triggering a general protection fault during inode eviction.

Why it matters to the business

Systems using the JFS filesystem can experience unexpected kernel crashes or denial of service, leading to unplanned downtime and potential data inconsistency on affected servers; low exploitation likelihood reduces urgency but still requires patching for stability.

How an attack unfolds

An attacker with local access triggers inode operations on a JFS filesystem mount where the inode map pointer is uninitialized, causing the kernel to dereference invalid memory during diFree and evict_inode paths, resulting in a crash.

How to fix it

Upgrade affected packages to the fixed versions provided: discourse/discourse-encrypt (GIT) to commit 9c75810af9a474d7edaec67dea66f852c0ba1f4e or later; for Linux kernel users apply the upstream JFS diFree null check fix.

How to confirm the fix worked

Confirm kernel or package version matches or exceeds the fixed commit; test inode creation/eviction workloads on JFS mounts and verify absence of GPF in logs; review source for the ipimap NULL guard in jfs_imap.c.

Typical attack path

1. Obtain local code execution or shell on target system
2. Mount or access a JFS filesystem with specific inode eviction conditions
3. Trigger iput or evict on an inode with null ipimap
4. Kernel hits diFree with invalid pointer and panics

How to detect it

Search kernel logs for diFree or jfs_evict_inode call traces with GPF faults; review audit logs for unusual JFS mount and inode activity preceding crashes; no widespread threat actor campaigns noted.

What your security team should do

• Prioritize upgrade of discourse-encrypt and any JFS-enabled kernels to fixed versions within standard maintenance windows
• Monitor for JFS-related kernel oops or GPF events in production logs
• Disable JFS mounts if not required until patched