PT-2024-11472 · Linux+6 · Linux Kernel+6
Stephen Boyd
·
Published
2021-10-13
·
Updated
2025-01-21
·
CVE-2021-47497
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.15.0-rc3+
Description
The issue arises when a cell has 'nbits' equal to a multiple of BITS PER BYTE. The logic
*p &= GENMASK((cell->nbits%BITS PER BYTE) - 1, 0) becomes undefined behavior because nbits modulo BITS PER BYTE is 0, and subtracting one from that results in a large number that is then shifted more than the number of bits that fit into an unsigned long. UBSAN reports this problem as a shift-out-of-bounds in drivers/nvmem/core.c.Recommendations
To resolve the issue, update the Linux kernel to a version that includes the fix for the shift-out-of-bound vulnerability.
For Linux kernel versions prior to 5.15.0-rc3+, consider applying the patch that fixes the shift-out-of-bound issue in the nvmem subsystem.
As a temporary workaround, consider disabling the
nvmem cell read function until a patch is available.Fix
Out of bounds Read
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linux Kernel
Red Hat
Rocky Linux
Suse