PT-2024-9285 · Linux+1 · Linux Kernel+1

Vincent Whitchurch · Published 2024-06-19 · Updated 2024-12-04 · CVE-2021-47613

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to the Linux kernel's virtio component, where the driver incorrectly assumes that the notify callback is only received when the device is done with all the queued buffers. However, the notify callback can be called without any of the queued buffers being completed, or with only some of the buffers being completed. This can lead to incorrect data on the I2C bus or memory corruption in the guest if the device operates on buffers that have been freed by the driver.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2024-10973

CVE-2021-47613

Affected Products

Linux Kernel

Red Os

References · 16

• https://git.kernel.org/stable/c/b503de239f62eca898cfb7e820d9a35499137d22 · Patch
• https://bdu.fstec.ru/vul/2024-10973 · Security Note
• https://git.kernel.org/stable/c/9cbb957441ed8873577d7d313a3d79d69f1dad5c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-47613 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47613 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-47613 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47613 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-47613 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-47613 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-47613 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note
• https://access.redhat.com/security/cve/CVE-2021-47613 · Note
• https://git.kernel.org/linus/b503de239f62eca898cfb7e820d9a35499137d22 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-kernel-lt-0412242 · Note
• https://lore.kernel.org/linux-cve-announce/2024061908-CVE-2021-47613-47d5@gregkh/T · Note