CVE-2021-47335 is a vulnerability identified in the Linux kernel's implementation of the F2FS (Flash-Friendly File System). The issue arises from a race condition involving multiple instances of the F2FS filesystem accessing a global slab cache pointer named fsync_entry_slab. Specifically, during the recovery process of F2FS, a use-after-free condition can occur when the slab cache is destroyed or re-initialized concurrently by different filesystem instances. This race leads to a use-after-free write, which is a memory corruption vulnerability where freed memory is accessed and potentially overwritten. The vulnerability was reported by syzbot, a kernel fuzzing tool, and involves functions such as kmem_cache_destroy, f2fs_recover_fsync_data, and f2fs_fill_super. The root cause is that the slab cache initialization and destruction were not properly synchronized across multiple F2FS instances, allowing concurrent access and modification. The fix involves ensuring that the slab cache is initialized and destroyed only once during the module's lifecycle, preventing concurrent races. This vulnerability affects Linux kernel versions containing the affected commit hashes and impacts systems using F2FS, which is commonly used on flash storage devices such as SSDs and eMMC, especially in embedded and mobile environments. Exploitation could lead to kernel memory corruption, potentially causing system crashes (denial of service) or enabling escalation of privileges if an attacker can manipulate the kernel memory state. No known exploits are reported in the wild as of the publication date.

For European organizations, the impact of CVE-2021-47335 depends largely on the deployment of Linux systems utilizing the F2FS filesystem. Many enterprises and service providers in Europe run Linux-based servers, desktops, and embedded devices. While F2FS is not the default filesystem for most server environments (which often use ext4 or XFS), it is increasingly used in embedded systems, IoT devices, and mobile devices that may be part of enterprise infrastructure or supply chains. Successful exploitation could lead to kernel crashes, resulting in denial of service, or potentially privilege escalation, which could compromise system integrity and confidentiality. This is particularly critical for organizations relying on Linux-based infrastructure for critical services, industrial control systems, or telecommunications equipment. Additionally, the vulnerability could be leveraged in targeted attacks against devices with F2FS, especially if attackers have local access or can induce mounts of malicious filesystems. The lack of known exploits reduces immediate risk but does not eliminate the threat, especially as attackers may develop exploits post-disclosure. European organizations with embedded Linux devices or those using F2FS in specialized environments should consider this vulnerability a significant risk to system stability and security.

To mitigate CVE-2021-47335, European organizations should: 1) Apply the official Linux kernel patches that fix the race condition by ensuring proper initialization and destruction of the fsync_entry_slab cache. This requires updating to a kernel version that includes the fix or backporting the patch if using long-term support kernels. 2) Audit and inventory systems to identify those using the F2FS filesystem, including embedded devices, mobile devices, and servers. 3) Limit local access to systems using F2FS to trusted users only, as exploitation requires local privileges to mount or recover F2FS filesystems. 4) Implement strict access controls and monitoring for filesystem mount operations and kernel logs to detect unusual activity related to F2FS mounts or recovery processes. 5) For embedded and IoT devices, coordinate with vendors to ensure firmware updates include the patched kernel. 6) Employ kernel hardening techniques such as Kernel Address Space Layout Randomization (KASLR), Kernel Page Table Isolation (KPTI), and other memory protection features to reduce the risk of exploitation. 7) Regularly monitor security advisories for any emerging exploits targeting this vulnerability and respond promptly.