PT-2021-8003 · Linux · Linux Kernel

Published 2021-04-21 · Updated 2025-01-09 · CVE-2021-47039

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a potential out of bounds condition in the do format() function of the ataflop component. The function uses the type variable as an array index, but the bounds check on type is not performed until later in the function. This could potentially allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The fix involves moving the bounds check to the start of the function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Out of bounds Read

Weakness Enumeration

CWE-129

CWE-125

Related Identifiers

BDU:2024-01752

CVE-2021-47039

Affected Products

Linux Kernel

References · 18

• https://git.kernel.org/stable/c/1ffec389a6431782a8a28805830b6fae9bf00af1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-47039 · Vendor Advisory
• https://git.kernel.org/stable/c/2a3a8bbca28b899806844c00d49ed1b7ccb50957 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-47039 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47039 · Vendor Advisory
• https://git.kernel.org/stable/c/07f86aa8f4fe077be1b018cc177eb8c6573e5671 · Patch
• https://ubuntu.com/security/CVE-2021-47039 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47039 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01752 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-47039 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47039 · Note
• https://twitter.com/CVEnew/status/1762754389650166061 · Twitter Post
• https://lore.kernel.org/linux-cve-announce/2024022837-CVE-2021-47039-638f@gregkh · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.21 · Note