PT-2024-9054 · Linux+3 · Linux Kernel+3

Zhangyue · Published 2024-05-24 · Updated 2024-11-26 · CVE-2021-47547

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to an out-of-bounds array access in the Linux kernel, specifically in the net: tulip: de4x5 component. The problem arises when the array 'lp->phy[8]' is accessed with an index that exceeds its bounds, potentially leading to a denial of service. The issue is caused by a logic error in the code, where the loop counter 'k' can reach a value of 8, resulting in an out-of-bounds access.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Improper Validation of Array Index

Weakness Enumeration

CWE-125

CWE-129

Related Identifiers

BDU:2024-10736

CVE-2021-47547

OESA-2024-1705

OPENSUSE-SU-2024_2947-1

SUSE-SU-2024:2493-1

SUSE-SU-2024:2561-1

SUSE-SU-2024:2894-1

SUSE-SU-2024:2901-1

SUSE-SU-2024:2939-1

SUSE-SU-2024:2947-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 1504

• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47547 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52754 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52753 · Security Note
• https://git.kernel.org/stable/c/61217be886b5f7402843677e4be7e7e83de9cb41 · Patch
• https://git.kernel.org/stable/c/142ead3dc70411bd5977e8c47a6d8bf22287b3f8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-36902 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47544 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47324 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52803 · Security Note
• https://git.kernel.org/stable/c/77ff166909458646e66450e42909e0adacc99049 · Patch
• https://git.kernel.org/stable/c/2c1a6a9a011d622a7c61324a97a49801ba425eff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-36883 · Security Note
• https://git.kernel.org/stable/c/d3dedaa5a601107cfedda087209772c76e364d58 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2939-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47329 · Security Note