Vulnerability Details : CVE-2021-44879
In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.
Vulnerability category: Memory Corruption
Exploit prediction scoring system (EPSS) score for CVE-2021-44879
Probability of exploitation activity in the next 30 days: 0.09%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 36 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2021-44879
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2021-44879
-
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-44879
-
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9056d6489f5a41cfbb67f719d2c0ce61ead72d9f
kernel/git/torvalds/linux.git - Linux kernel source treeMailing List;Patch;Vendor Advisory
-
https://lore.kernel.org/linux-f2fs-devel/20211206144421.3735-3-chao@kernel.org/T/
[f2fs-dev] [PATCH 1/3] f2fs: fix to do sanity check on inode type during garbage collectionMailing List;Patch;Vendor Advisory
-
https://bugzilla.kernel.org/show_bug.cgi?id=215231
215231 – kernel NULL pointer dereference triggered in folio_mark_dirty() when mount and operate on a crafted f2fs imageExploit;Issue Tracking;Vendor Advisory
-
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3
Mailing List;Vendor Advisory
-
https://lore.kernel.org/linux-f2fs-devel/20211206144421.3735-3-chao%40kernel.org/T/
[f2fs-dev] [PATCH 1/3] f2fs: fix to do sanity check on inode type during garbage collection
-
https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html
[SECURITY] [DLA 3711-1] linux-5.10 security update
-
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
[SECURITY] [DLA 3710-1] linux security update
Products affected by CVE-2021-44879
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*