PT-2024-11286 · Linux+1 · Linux Kernel+1

Joe Burmeister · Published 2021-05-24 · Updated 2024-05-21 · CVE-2021-47282

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to an out-of-bounds access in the Linux kernel's spi: bcm2835 driver. This occurs when there are more than 4 slaves, and the num chipselect limitation is silently raised by of spi get gpio numbers(), resulting in out-of-bounds accesses to the prepare cs[] array. The problem arises because num chipselect only limits the number of native chipselects, and GPIO chipselects specified in the device tree can exceed this limit. A bandaid fix has been applied to raise the number of allowed slaves to 24 and enforce the limitation on slave setup, with an upcoming commit planned to allow an arbitrary number of slaves.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

BDU:2025-15375

CVE-2021-47282

Affected Products

Astra Linux

Linux Kernel

References · 19

• https://git.kernel.org/stable/c/82a8ffba54d31e97582051cb56ba1f988018681e · Patch
• https://git.kernel.org/stable/c/01415ff85a24308059e06ca3e97fd7bf75648690 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-47282 · Vendor Advisory
• https://git.kernel.org/stable/c/b5502580cf958b094f3b69dfe4eece90eae01fbc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-47282 · Security Note
• https://git.kernel.org/stable/c/13817d466eb8713a1ffd254f537402f091d48444 · Patch
• https://cve.org/CVERecord?id=CVE-2021-47282 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47282 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-47282 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15375 · Security Note
• https://ubuntu.com/security/CVE-2021-47282 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47282 · Vendor Advisory
• https://git.kernel.org/linus/13817d466eb8713a1ffd254f537402f091d48444 · Note
• https://twitter.com/CVEnew/status/1792927999517397387 · Twitter Post
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.44 · Note