CVE-2021-47366

CVE-2021-47366 describes a data corruption vulnerability in the Linux kernel's AFS client when reading files between 2GB and 4GB from an OpenAFS server. This occurs because the client incorrectly uses a 32-bit signed value for file position in FS.FetchData RPCs, leading to sign extension issues. The vulnerability affects Linux kernel versions interacting with OpenAFS servers, causing data integrity problems such as corrupted git pack files. The vulnerability is rated Medium severity (CVSS 5.5) with a local attack vector and low attack complexity. The primary impact is high availability impact (A:H) due to data corruption, with no direct impact on confidentiality or integrity of the system itself. The issue is categorized under CWE-787 (Out-of-bounds Write). There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness or concern.