CVE-2021-47342

What it actually does

Use-after-free in ext4 when remounting a MMP-protected filesystem read-only: after ext4_fill_super the kmmpd thread may exit leaving sbi->s_mmp_tsk pointing at freed memory that ext4_stop_mmpd later dereferences.

Why it matters to the business

Kernel memory corruption or crash on systems using ext4 with multi-mount protection; potential local privilege escalation or denial of service during routine administrative remount operations.

How an attack unfolds

An attacker with the ability to trigger or observe a read-only remount of an MMP-protected ext4 filesystem races the kmmpd exit with the call to ext4_stop_mmpd, causing the kernel to access already-freed task_struct memory.

How to fix it

Apply the upstream fix that prevents kmmpd from exiting except when stopped via ext4_stop_mmpd; for drupal/drupal (GIT) update to commit 4576b6a4f1ac7e94a7547f226892a01999026cf2 or later equivalent kernel patch.

How to confirm the fix worked

Confirm the patch is present by inspecting the ext4 code for the conditional kmmpd exit logic; attempt a read-only remount on an MMP-enabled filesystem and verify no UAF warnings or crashes occur.

Typical attack path

1. Mount ext4 filesystem with MMP enabled
2. Trigger or wait for administrative remount to read-only
3. Race kmmpd thread exit against ext4_stop_mmpd
4. Kernel dereferences freed s_mmp_tsk pointer

How to detect it

Search kernel logs for ext4 MMP-related warnings or use-after-free stack traces involving ext4_stop_mmpd and kmmpd; inspect for unexpected process exits of kworker threads during remount events.

What your security team should do

• Prioritize patching all Linux kernels using ext4 with MMP enabled
• Restrict unprivileged users from performing remount operations on MMP filesystems until fixed
• Monitor for ext4 UAF reports in kernel logs on affected systems