PT-2024-11291 · Linux+2 · Linux Kernel+2
Published
2021-07-19
·
Updated
2025-06-18
·
CVE-2021-47288
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is an out-of-bounds bug in the
ngene command config free buf() function. The problem arises because the original code attempts to copy 6 bytes of data into a one-byte size member config of the wrong structure FW CONFIGURE BUFFERS in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. The correct structure should be FW CONFIGURE FREE BUFFERS instead, as it contains 6 more members apart from the header hdr. The fix involves enclosing those 6 members of struct FW CONFIGURE FREE BUFFERS into a new struct config and using &com.cmd.ConfigureFreeBuffers.config as the destination address when calling memcpy(). This change also aids in the ongoing efforts to globally enable -Warray-bounds and tighten the FORTIFY SOURCE routines on memcpy().Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Suse