PT-2024-11098 · Linux+1 · Linux Kernel+1

Qais Yousef · Published 2021-05-06 · Updated 2024-12-24 · CVE-2021-46993

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to an out-of-bound access in the uclamp component of the Linux kernel. Util-clamp places tasks in different buckets based on their clamp values for performance reasons. However, the size of buckets is currently computed using a rounding division, which can lead to an off-by-one error in some configurations. For instance, with 20 buckets, the bucket size will be 1024/20=51. A task with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly, correct indexes are in range [0,19], hence leading to an out of bound memory access. The issue can be fixed by clamping the bucket id.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2025-05321

CVE-2021-46993

Affected Products

Astra Linux

Linux Kernel

References · 25

• https://git.kernel.org/stable/c/f7347c85490b92dd144fa1fba9e1eca501656ab3 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-46993 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46993 · Vendor Advisory
• https://git.kernel.org/stable/c/6d2f8909a5fabb73fe2a63918117943986c39b6c · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46993 · Vendor Advisory
• https://git.kernel.org/stable/c/42ee47c7e3569d9a0e2cb5053c496d97d380472f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-46993 · Security Note
• https://git.kernel.org/stable/c/3da3f804b82a0a382d523a21acf4cf3bb35f936d · Patch
• https://bdu.fstec.ru/vul/2025-05321 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-46993 · Security Note
• https://git.kernel.org/stable/c/687f523c134b7f0bd040ee1230f6d17990d54172 · Patch
• https://osv.dev/vulnerability/CVE-2021-46993 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46993 · Vendor Advisory
• https://git.linuxtesting.ru/pub/scm/linux/kernel/git/lvc/linux-stable.git/commit/?h=v5.10.176-lvc1&id=f7347c85490b92dd144fa1fba9e1eca501656ab3 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.5 · Note