CVE-2021-47351

What it actually does

Race condition between concurrent xattr set/get and listxattr operations in UBIFS allows assertion failures, memory corruption, or stale xattr values due to unsynchronized write access on ubifs_inode.

Why it matters to the business

Filesystem instability, data corruption, or crashes on affected systems can disrupt operations, require recovery efforts, and risk loss of extended attribute data.

How an attack unfolds

An attacker with local access performs simultaneous xattr set, get, and list operations on a UBIFS volume to trigger the unsynchronized window and induce corruption or crashes.

How to fix it

Apply the fix by upgrading to a kernel containing commit 37b48b82a4bc7680c6e4c42647209010cb239c2c; rebuild and reboot with the patched UBIFS module.

How to confirm the fix worked

Confirm the updated kernel is running, reproduce concurrent xattr workloads under stress testing, and verify absence of assertions or corruption in logs and filesystem checks.

Typical attack path

1. Obtain local access to a system using UBIFS
2. Mount or access a UBIFS filesystem
3. Issue concurrent xattr set/get and listxattr calls from multiple threads or processes
4. Trigger the race to produce assertion failure, corruption, or stale values

How to detect it

Review kernel logs for UBIFS assertion failures or memory corruption messages during xattr operations; inspect for unexpected stale extended attributes after concurrent access.

What your security team should do

• Prioritize patching all systems using UBIFS within the next maintenance window due to potential for local denial of service
• Monitor kernel changelogs for UBIFS-related fixes
• Restrict local user access on multi-user systems until patched