CVE-2021-47458

What it actually does

Mounting an ocfs2 filesystem triggers a buffer overflow in strlen because cluster stack and name strings from disk are not guaranteed null-terminated, violating strlcpy assumptions and activating FORTIFY_SOURCE panic in the kernel.

Why it matters to the business

Systems running affected kernels with ocfs2 cannot mount filesystems using o2cb or pcmk stacks, causing immediate operational failure for clustered storage workloads; low EPSS and no KEV status indicate limited active threat but high impact on availability for dependent environments.

How an attack unfolds

An attacker with local access supplies a maliciously crafted ocfs2 filesystem image containing non-null-terminated strings for cluster stack or name; when the victim runs mount.ocfs2 the kernel's ocfs2_fill_super path calls ocfs2_initialize_super which performs unsafe string handling, triggering the fortify_panic.

How to fix it

Upgrade to a fixed kernel version that ensures null termination before strlcpy; for themeum/tutor (GIT) apply commit 05f3d05df7bc95e889c568cba9faf9b04bbad128.

How to confirm the fix worked

Confirm kernel version no longer panics on mount of crafted ocfs2 images; verify string handling in ocfs2_initialize_super uses bounded copy; check fixed commit presence in source.

Typical attack path

1. Prepare ocfs2 filesystem image with non-null-terminated cluster metadata
2. Induce or wait for target to execute mount.ocfs2 on the image
3. Kernel performs strlen on unterminated source triggering FORTIFY_SOURCE check
4. Kernel BUG at lib/string.c causes panic and denial of service

How to detect it

Search kernel logs for 'detected buffer overflow in strlen' and 'fortify_panic' entries originating from ocfs2_fill_super or mount.ocfs2; inspect audit logs for recent mount attempts of ocfs2 volumes.

• fortify_panic+0xf/0x11
• ocfs2_initialize_super.isra.0.cold
• detected buffer overflow in strlen
• kernel BUG at lib/string.c:1149

What your security team should do

• Prioritize kernel updates on all systems using ocfs2
• Restrict local mount privileges until patched
• Monitor for fortify_panic events in kernel logs
• Test mounts with representative cluster stack configurations post-update