CVE-2021-47366 is a vulnerability in the Linux kernel's implementation of the OpenAFS client, specifically in how it handles file read operations from an OpenAFS server. OpenAFS uses two Remote Procedure Call (RPC) variants for data fetching: FS.FetchData and FS.FetchData64. The Linux AFS client switches between these based on the read size, file position, or their sum having the upper 32 bits set in a 64-bit value. However, the FS.FetchData RPC uses signed 32-bit values for file position and length, which leads to incorrect interpretation when values exceed the signed 32-bit range, causing data corruption during reads at file positions between 2GB and 4GB. The root cause is that the client incorrectly switches between FS.FetchData and FS.FetchData64 based on upper 32 bits rather than the server's capabilities. The fix involves capturing the server's capability flags via FS.GetCapabilities RPC, specifically the VICED_CAPABILITY_64BITFILES flag, to correctly decide which RPC variant to use for fetching and storing data. This prevents the client from misinterpreting file positions and lengths and avoids data corruption. The vulnerability manifests as errors when accessing large files (2GB-4GB range) on OpenAFS servers, such as git packfile mismatches during operations like 'git status'. The issue does not affect FS.StoreData because it uses unsigned 32-bit values, nor does it affect Auristor servers which use unsigned 64-bit values for their YFS.FetchData64 operation. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The vulnerability was published on May 21, 2024, and affects Linux kernel versions containing the specified commit hashes.

For European organizations using Linux systems with OpenAFS clients connected to OpenAFS servers, this vulnerability can lead to silent data corruption when reading large files between 2GB and 4GB. This can cause integrity issues in critical file operations, such as source code repositories (e.g., git), large data files, or any application relying on OpenAFS for distributed file storage. Corrupted reads can result in application errors, data inconsistency, and potential disruption of workflows dependent on accurate file access. While the vulnerability does not appear to allow remote code execution or privilege escalation, the integrity compromise can affect software development, data analytics, and other sectors relying on large file handling. The lack of known exploits reduces immediate risk, but the subtlety of data corruption means detection may be delayed, increasing potential damage. Availability impact is minimal, as the issue causes read errors rather than system crashes. Confidentiality is not directly impacted. Overall, the threat primarily affects data integrity in environments using OpenAFS on Linux, which may include research institutions, universities, and enterprises with legacy distributed file systems.

European organizations should ensure their Linux kernels are updated to versions containing the patch that correctly implements capability flag checks for OpenAFS clients, specifically verifying the presence of the VICED_CAPABILITY_64BITFILES flag before choosing FS.FetchData or FS.FetchData64 RPCs. Administrators should audit their environments for OpenAFS usage and identify clients and servers involved in large file operations. Testing with large files (2GB-4GB) can help detect corruption symptoms. Where possible, migrating from OpenAFS to more modern distributed file systems that handle large files robustly is advisable. Additionally, organizations should implement integrity verification mechanisms for critical files, such as checksums or digital signatures, to detect corruption early. Monitoring OpenAFS server logs for anomalous FetchData requests with suspicious file positions can aid in early detection. Backup strategies should be reviewed to ensure recovery from corrupted data. Since no known exploits exist, immediate patching is the best preventive measure to avoid future exploitation.