CVE-2021-47458

Q: What is the severity of CVE-2021-47458?

CVE-2021-47458 has a CVSS score of 7.8 (HIGH). A buffer overflow vulnerability in the Linux kernel's OCFS2 filesystem driver allows local attackers to trigger a kernel panic (denial of service) when mounting OCFS2 filesystems. The vulnerability affects systems with CONFIG_FORTIFY_SOURCE enabled and using OCFS2 with o2cb or pcmk cluster stacks. Attackers with local access can crash the system by mounting specially crafted OCFS2 filesystems.

7.8 HIGH

Denial of Service Buffer Overflow

📋 TL;DR

A buffer overflow vulnerability in the Linux kernel's OCFS2 filesystem driver allows local attackers to trigger a kernel panic (denial of service) when mounting OCFS2 filesystems. The vulnerability affects systems with CONFIG_FORTIFY_SOURCE enabled and using OCFS2 with o2cb or pcmk cluster stacks. Attackers with local access can crash the system by mounting specially crafted OCFS2 filesystems.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel 5.11 through 5.14.6-2 (specifically versions with the vulnerable OCFS2 code)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when CONFIG_FORTIFY_SOURCE is enabled and OCFS2 filesystem with o2cb or pcmk cluster stack is used. Most distributions don't enable OCFS2 by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, though this is unlikely as the vulnerability primarily triggers a panic via FORTIFY_SOURCE detection.

🟠

Likely Case

Local denial of service through kernel panic when mounting malicious OCFS2 filesystems, requiring system reboot.

🟢

If Mitigated

No impact if systems don't use OCFS2 filesystems or have CONFIG_FORTIFY_SOURCE disabled.

🌐 Internet-Facing: LOW - Requires local filesystem access, not remotely exploitable.

🏢 Internal Only: MEDIUM - Local attackers with filesystem access can cause denial of service.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access to create/mount OCFS2 filesystems. The vulnerability is triggered during mount operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits 0e677ea5b7396f715a76b6b0ef441430e4c4b57f or later

Vendor Advisory: https://git.kernel.org/stable/c/0e677ea5b7396f715a76b6b0ef441430e4c4b57f

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version with 'uname -r'.

🔧 Temporary Workarounds

Disable CONFIG_FORTIFY_SOURCE

linux

Disable FORTIFY_SOURCE kernel configuration to prevent buffer overflow detection from triggering panic

Rebuild kernel with CONFIG_FORTIFY_SOURCE=n

Avoid OCFS2 mounting

linux

Prevent mounting of OCFS2 filesystems from untrusted sources

Remove OCFS2 kernel module: rmmod ocfs2
Blacklist OCFS2 module: echo 'blacklist ocfs2' > /etc/modprobe.d/blacklist-ocfs2.conf

🧯 If You Can't Patch

Restrict local user access to prevent untrusted users from mounting filesystems
Disable OCFS2 kernel module and avoid using OCFS2 filesystems

🔍 How to Verify

Check if Vulnerable:

Check kernel version: 'uname -r' and verify if between 5.11 and 5.14.6-2. Check if OCFS2 module is loaded: 'lsmod | grep ocfs2'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched (after 5.14.6-2) and test mounting OCFS2 filesystem doesn't trigger panic

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages with 'detected buffer overflow in strlen'
OCFS2 mount failures in system logs
Kernel BUG at lib/string.c:1149 in dmesg

Network Indicators:

No network indicators - local filesystem vulnerability

SIEM Query:

source="kernel" AND "buffer overflow in strlen" OR "ocfs2_initialize_super" OR "fortify_panic"

📊 Metadata

CVE ID: CVE-2021-47458

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: May 22, 2024

Last Updated: September 23, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable CONFIG_FORTIFY_SOURCE

Avoid OCFS2 mounting

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities