PT-2024-8864 · Linux+3 · Linux Kernel+3

Mike Marciniszyn · Published 2024-05-24 · Updated 2024-11-26 · CVE-2021-47523

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a leak of the rcvhdrtail dummy kvaddr buffer in the IB/hfi1 component of the Linux kernel. This leak occurs when the reinit path overwrites the old allocation, causing it to be lost. The vulnerability allows an attacker to potentially gain access to confidential information. The fix involves moving the allocation of the buffer to hfi1 alloc devdata() and the deallocation to hfi1 free devdata().

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Memory Leak

Weakness Enumeration

CWE-200

CWE-401

Related Identifiers

BDU:2024-10531

CVE-2021-47523

OPENSUSE-SU-2024_2185-1

OPENSUSE-SU-2024_2189-1

SUSE-SU-2024:1979-1

SUSE-SU-2024:1983-1

SUSE-SU-2024:2008-1

SUSE-SU-2024:2010-1

SUSE-SU-2024:2011-1

SUSE-SU-2024:2019-1

SUSE-SU-2024:2184-1

SUSE-SU-2024:2185-1

SUSE-SU-2024:2189-1

SUSE-SU-2024:2190-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 1504

• 🔥 https://github.com/lanleft/CVE-2023-1829 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2024:1983-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-47523 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-47523 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1979-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-47523 · Vendor Advisory
• https://git.kernel.org/stable/c/834d0fb978643eaf09da425de197cc16a7c2761b · Patch
• https://git.kernel.org/stable/c/60a8b5a1611b4a26de4839ab9c1fc2a9cf3e17c1 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2010-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2011-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47523 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47523 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2019-1 · Vendor Advisory
• https://git.kernel.org/stable/c/2c08271f4ed0e24633b3f81ceff61052b9d45efc · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2190-1 · Vendor Advisory