CVE-2021-47343: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47343 is a vulnerability in the Linux kernel's device mapper (dm) btree removal functionality. The issue was discovered in May 2024 and affects the dm_btree_remove() function. The vulnerability occurs when remove_raw() fails due to IO read errors during block shadowing, causing an uninitialized shadow_spine::root value to be assigned to new_root (NVD).

The vulnerability exists in the dm_btree_remove() function where an uninitialized value from shadow_spine::root is assigned to new_root even when the removal operation fails. For dm-thin, this results in pmd->details_root or pmd->root receiving an uninitialized value. When attempting to read the details_info tree subsequently, out-of-bound memory access occurs, leading to a general protection fault with non-canonical addresses (Kernel Patch).

When exploited, this vulnerability can cause out-of-bound memory access in the Linux kernel, potentially leading to system crashes through general protection faults. The issue specifically affects the device mapper's thin provisioning functionality, which could impact storage management operations (NVD).

The vulnerability can be triggered during normal system operations when there are IO read errors during block shadowing operations in the device mapper. The issue manifests particularly when attempting to delete thin devices, as demonstrated by the crash occurring during dmsetup operations (Kernel Patch).

The issue has been fixed by modifying the dm_btree_remove() function to only assign new_root when the removal operation succeeds. The fix involves adding a conditional check before assigning the shadow_root value (Kernel Patch).