PT-2024-11290 · Linux+1 · Linux Kernel+1

Published 2021-07-16 · Updated 2024-05-21 · CVE-2021-47286

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue concerns the Linux kernel, where the MHI (Mobile Host Interface) core does not properly validate channel IDs when processing command completions. This could lead to out-of-bounds accesses, as the channel ID read from the event ring element sent by the device can be any value between 0 and 255. To prevent this, a check has been added against the maximum number of channels supported by the controller and those channels not configured yet, so as to skip processing of that event ring element.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

BDU:2025-14369

CVE-2021-47286

Affected Products

Astra Linux

Linux Kernel

References · 16

• https://security-tracker.debian.org/tracker/CVE-2021-47286 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-47286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47286 · Security Note
• https://git.kernel.org/stable/c/3efec3b4b16fc7af25676a94230a8ab2a3bb867c · Patch
• https://git.kernel.org/stable/c/546362a9ef2ef40b57c6605f14e88ced507f8dd0 · Patch
• https://git.kernel.org/stable/c/aed4f5b51aba41e2afd7cfda20a0571a6a67dfe9 · Patch
• https://ubuntu.com/security/CVE-2021-47286 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47286 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14369 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47286 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-47286 · Security Note
• https://lore.kernel.org/linux-cve-announce/2024052119-CVE-2021-47286-c242@gregkh · Note
• https://git.linuxtesting.ru/pub/scm/linux/kernel/git/lvc/linux-stable.git/commit/?h=v5.10.176-lvc1&id=3efec3b4b16fc7af25676a94230a8ab2a3bb867c · Note
• https://git.kernel.org/linus/546362a9ef2ef40b57c6605f14e88ced507f8dd0 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.54 · Note