Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2021-47066
CVE-2021-47066:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2021-47066 is a vulnerability in the Linux kernel's asyncxor functionality that affects versions from 5.10 to 5.12.4. The issue arises when calculating XOR values with different offsets for each r5dev in RAID5 configurations, particularly when PAGESIZE is not equal to stripe size (NVD).
Technical details
The vulnerability occurs in the asyncxor functionality where, in RMW (Read-Modify-Write) mode, the parity page is used as a source page. When ASYNCTXXORDROPDST is set before calculating XOR value in opsrunprexor5, it needs to increment both srclist and srcoffs simultaneously. The bug results from only incrementing srclist, leading to incorrect XOR value calculations. The vulnerability has a CVSS v3.1 Base Score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).
Impact
The vulnerability can cause data corruption problems in RAID5 configurations. This is particularly reproducible on POWER8 machines when attempting to mount an XFS filesystem on a RAID5 array, resulting in structure cleaning errors (Kernel Patch).
Mitigation and workarounds
The issue has been fixed in the Linux kernel through a patch that properly increments srcoffs when dropping the destination page. The fix involves adding a single line of code to increment srcoffs along with srclist when ASYNCTXXORDROP_DST is set (Kernel Patch).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management