CVE-2021-47375 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2021-47375?

CVE-2021-47375 has a CVSS score of 6.2 (MEDIUM). This is a use-after-free vulnerability in the Linux kernel's blktrace subsystem that allows local attackers to cause a kernel NULL pointer dereference, leading to denial of service (system crash). It affects Linux systems where blktrace is enabled and can be triggered by users with access to block device ioctl operations.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's blktrace subsystem that allows local attackers to cause a kernel NULL pointer dereference, leading to denial of service (system crash). It affects Linux systems where blktrace is enabled and can be triggered by users with access to block device ioctl operations.

💻 Affected Systems

Products:

Linux Kernel

Versions: Multiple stable kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires blktrace to be enabled and users to have access to block device ioctl operations. Not vulnerable by default on most distributions.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to complete system crash and denial of service, potentially causing data corruption or loss.

🟠

Likely Case

Local denial of service through kernel crash, requiring system reboot to recover.

🟢

If Mitigated

Minimal impact if blktrace is disabled or access to block device ioctl operations is restricted.

🌐 Internet-Facing: LOW - Requires local access to trigger via ioctl operations.

🏢 Internal Only: MEDIUM - Local users or processes with block device access can cause system crashes.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires local access and specific timing conditions. The reproduction method is documented in the CVE description.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 3815fe7371d2411ce164281cef40d9fc7b323dee, 488da313edf3abea7f7733efe011c96b23740ab5, 5afedf670caf30a2b5a52da96eb7eac7dee6a9c9, 677e362ba807f3aafe6f405c07e0b37244da5222, a5f8e86192612d0183047448d8bbe7918b3f1a26

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for specific patched versions. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable blktrace

linux

Prevent use of blktrace subsystem to eliminate attack surface

echo 0 > /sys/kernel/debug/tracing/events/block/enable
rmmod blktrace

Restrict block device access

linux

Limit which users can access block device ioctl operations

chmod 600 /dev/sd*
setfacl -m u:root:rw- /dev/sd*

🧯 If You Can't Patch

Disable blktrace module and remove access to /sys/block/*/trace/enable
Implement strict access controls on block devices and monitor for suspicious ioctl activity

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if blktrace is loaded: uname -r && lsmod | grep blktrace

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched: grep -q 'blk_trace_remove_queue.*running_list' /proc/kallsyms || echo 'Patched'

📡 Detection & Monitoring

Log Indicators:

Kernel NULL pointer dereference messages
BUG: kernel NULL pointer dereference in trace_note
blktrace related crashes in dmesg

Network Indicators:

None - local exploit only

SIEM Query:

source="kernel" AND "NULL pointer dereference" AND "trace_note"

📊 Metadata

CVE ID: CVE-2021-47375

CVSS v3 Score: 6.2 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-416

Published: May 21, 2024

Last Updated: April 2, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47375, you might also want to check these: