Security readout for executives and security teams
Plain-English summary
This is a Linux kernel OCFS2 filesystem bug that can corrupt files during specific fallocate operations. The business risk is data reliability, not remote compromise. The CVE is medium severity, local, and requires some local privilege, but affected storage or image-conversion workflows could suffer meaningful availability or data integrity impact.
Executive priority
Treat as a targeted reliability issue for OCFS2 environments. It should be patched through normal kernel maintenance, with higher urgency for shared storage or image-processing systems where corruption could affect operations.
Technical view
OCFS2 could corrupt data when fallocate punched holes beyond inode size, then extended the inode while writeback occurred. Pages beyond the old inode size could be dropped before the new size was applied. The kernel fix zeroes EOF blocks when extending inode size.
Likely exposure
Exposure is most likely on Linux systems using OCFS2 with workloads that punch holes and extend files via fallocate. The source specifically cites qemu-img conversion behavior as an easy corruption trigger. Systems not using OCFS2 are not indicated as exposed by the provided description.
Exploitation context
The CVSS vector is local, low complexity, low privileges, and no user interaction. The source bundle does not indicate active exploitation, and KEV is false. The public description provides a reproducible workload context but not evidence of weaponized exploitation.
Researcher notes
The evidence describes a race-like ordering problem between fallocate, inode size extension, EOF zeroing, and writeback. Public sources identify kernel stable commits but do not provide distro-specific package status or exploitation in the wild.
Mitigation direction
- Update affected Linux kernels to versions containing the referenced stable fixes.
- Confirm vendor distribution advisories for exact fixed package versions.
- Prioritize OCFS2 systems handling virtual disk image conversion or sparse-file workflows.
- Avoid relying on unsupported kernel builds for OCFS2 storage workloads.
Validation and detection
- Inventory Linux hosts using OCFS2 filesystems.
- Check kernel versions against vendor advisories and referenced stable commits.
- Review storage workflows using fallocate punch-hole and file-extension behavior.
- Look for unexplained file corruption in OCFS2-backed image conversion workloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47114 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/624fa7baa3788dc9e57840ba5b94bc22b03cda57CVE reference, Linux
- https://git.kernel.org/stable/c/33e03adafb29eedae1bae9cdb50c1385279fcf65CVE reference, Linux
- https://git.kernel.org/stable/c/a1700479524bb9cb5e8ae720236a6fabd003acaeCVE reference, Linux
- https://git.kernel.org/stable/c/cec4e857ffaa8c447f51cd8ab4e72350077b6770CVE reference, Linux
- https://git.kernel.org/stable/c/cc2edb99ea606a45182b5ea38cc8f4e583aa0774CVE reference, Linux
- https://git.kernel.org/stable/c/c8d5faee46242c3f33b8a71a4d7d52214785bfccCVE reference, Linux
- https://git.kernel.org/stable/c/0a31dd6fd2f4e7db538fb6eb1f06973d81f8dd3bCVE reference, Linux
- https://git.kernel.org/stable/c/6bba4471f0cc1296fe3c2089b9e52442d3074b2eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.