PT-2021-7995 · Linux · Linux Kernel

Colin Ian King · Published 2021-04-17 · Updated 2025-01-09 · CVE-2021-47040

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a buffer overflow in the io provide buffers prep() function, which could allow a remote attacker to impact the confidentiality, integrity, and availability of data. The problem was reported by Colin, who noted possible overflow and sign extension issues. The fix involves using check overflow helpers and changing the type of struct io provide buf::len to unsigned, as it doesn't make sense to keep it signed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-01683

CVE-2021-47040

OESA-2024-1345

OESA-2024-1346

Affected Products

Linux Kernel

References · 45

• https://nvd.nist.gov/vuln/detail/CVE-2021-47013 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52458 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47040 · Security Note
• https://ubuntu.com/security/CVE-2021-47040 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-47040 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47049 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36778 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47086 · Security Note
• https://bdu.fstec.ru/vul/2024-01683 · Security Note
• https://git.kernel.org/stable/c/51bf90901952aaac564bbdb36b2b503050c53dd9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-52603 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47024 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-46941 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47040 · Vendor Advisory