CVE-2021-4155

A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This issue can be mitigated by ensuring xfs_alloc_file_space is not called with "0" as an argument.

This can be done with a SystemTap script (which resets "0" with XFS_BMAPI_PREALLOC), below are the steps:

1. Save the following script in a 'CVE-2021-4155.stp' file

--- On Red Hat Enterprise Linux 6 --- probe module("xfs").function("xfs_alloc_file_space") { if ($alloc_type == 0) $alloc_type = 0x40; # XFS_BMAPI_PREALLOC } --- On Red Hat Enterprise Linux 6 ---

--- On Red Hat Enterprise Linux 7 onwards --- probe module("xfs").function("xfs_alloc_file_space") { if ($alloc_type == 0) $alloc_type = 0x8; # XFS_BMAPI_PREALLOC } --- On Red Hat Enterprise Linux 7 onwards ---

2. Install systemtap package and its dependencies

   yum install -y systemtap systemtap-runtime

   yum install -y kernel-devel kernel-debuginfo

3. Build the mitigation kernel module as root.

   stap -r uname -r -m cve_2021_4155.ko -g CVE-2021-4155.stp -p4

4. Load the mitigation module as root

   staprun -L cve_2021_4155.ko

What is SystemTap and how to use it? https://access.redhat.com/solutions/5441