CVE-2021-47240 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB Read in qrtr_endpoint_post Syzbot reported slab-out-of-bounds Read in qrtr_endpoint_post. The problem was in wrong _size_ type: if (len != ALIGN(size, 4) + hdrlen) goto err; If size from qrtr_hdr is 4294967293 (0xfffffffd), the result of ALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293 in header this check won't fail and skb_put_data(skb, data + hdrlen, size); will read out of bound from data, which is hdrlen allocated block.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe
https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f
https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8
https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d
https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6
https://lore.kernel.org/linux-cve-announce/2024052141-CVE-2021-47240-b6f9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2021-47240
https://www.cve.org/CVERecord?id=CVE-2021-47240

History

Mon, 04 Nov 2024 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-21T14:19:40.363Z

Updated: 2024-11-04T12:02:06.617Z

Reserved: 2024-04-10T18:59:19.532Z

Link: CVE-2021-47240

Vulnrichment

Updated: 2024-08-04T05:32:08.052Z

NVD

Status : Awaiting Analysis

Published: 2024-05-21T15:15:13.177

Modified: 2024-05-21T16:54:26.047

Link: CVE-2021-47240

Redhat

Severity : Moderate

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2021-47240 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47240", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-04-10T18:59:19.532Z", "datePublished": "2024-05-21T14:19:40.363Z", "dateUpdated": "2024-11-04T12:02:06.617Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:02:06.617Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix OOB Read in qrtr_endpoint_post\n\nSyzbot reported slab-out-of-bounds Read in\nqrtr_endpoint_post. The problem was in wrong\n_size_ type:\n\n\tif (len != ALIGN(size, 4) + hdrlen)\n\t\tgoto err;\n\nIf size from qrtr_hdr is 4294967293 (0xfffffffd), the result of\nALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293\nin header this check won't fail and\n\n\tskb_put_data(skb, data + hdrlen, size);\n\nwill read out of bound from data, which is hdrlen allocated block."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/qrtr/qrtr.c"], "versions": [{"version": "194ccc88297a", "lessThan": "f8111c0d7ed4", "status": "affected", "versionType": "git"}, {"version": "194ccc88297a", "lessThan": "26b8d10703a9", "status": "affected", "versionType": "git"}, {"version": "194ccc88297a", "lessThan": "960b08dd36de", "status": "affected", "versionType": "git"}, {"version": "194ccc88297a", "lessThan": "19892ab9c9d8", "status": "affected", "versionType": "git"}, {"version": "194ccc88297a", "lessThan": "ad9d24c9429e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/qrtr/qrtr.c"], "versions": [{"version": "4.15", "status": "affected"}, {"version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.196", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.128", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.46", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.13", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6"}, {"url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f"}, {"url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8"}, {"url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe"}, {"url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d"}], "title": "net: qrtr: fix OOB Read in qrtr_endpoint_post", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47240", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-23T21:23:18.343399Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:14:27.293Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.052Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.052Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47240", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-23T21:23:18.343399Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T21:23:53.144Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "net: qrtr: fix OOB Read in qrtr_endpoint_post", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "194ccc88297a", "lessThan": "f8111c0d7ed4", "versionType": "git"}, {"status": "affected", "version": "194ccc88297a", "lessThan": "26b8d10703a9", "versionType": "git"}, {"status": "affected", "version": "194ccc88297a", "lessThan": "960b08dd36de", "versionType": "git"}, {"status": "affected", "version": "194ccc88297a", "lessThan": "19892ab9c9d8", "versionType": "git"}, {"status": "affected", "version": "194ccc88297a", "lessThan": "ad9d24c9429e", "versionType": "git"}], "programFiles": ["net/qrtr/qrtr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"status": "unaffected", "version": "0", "lessThan": "4.15", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.196", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.128", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.46", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.12.13", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "semver", "lessThanOrEqual": "*"}], "programFiles": ["net/qrtr/qrtr.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6"}, {"url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f"}, {"url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8"}, {"url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe"}, {"url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d"}], "x_generator": {"engine": "bippy-c8e10e5f6187"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix OOB Read in qrtr_endpoint_post\n\nSyzbot reported slab-out-of-bounds Read in\nqrtr_endpoint_post. The problem was in wrong\n_size_ type:\n\n\tif (len != ALIGN(size, 4) + hdrlen)\n\t\tgoto err;\n\nIf size from qrtr_hdr is 4294967293 (0xfffffffd), the result of\nALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293\nin header this check won't fail and\n\n\tskb_put_data(skb, data + hdrlen, size);\n\nwill read out of bound from data, which is hdrlen allocated block."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:37:24.866Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47240", "state": "PUBLISHED", "dateUpdated": "2024-11-04T11:37:24.866Z", "dateReserved": "2024-04-10T18:59:19.532Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-21T14:19:40.363Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: net: qrtr: fix OOB Read in qrtr_endpoint_post", "id": "2282577", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282577"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: qrtr: fix OOB Read in qrtr_endpoint_post\nSyzbot reported slab-out-of-bounds Read in\nqrtr_endpoint_post. The problem was in wrong\n_size_ type:\nif (len != ALIGN(size, 4) + hdrlen)\ngoto err;\nIf size from qrtr_hdr is 4294967293 (0xfffffffd), the result of\nALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293\nin header this check won't fail and\nskb_put_data(skb, data + hdrlen, size);\nwill read out of bound from data, which is hdrlen allocated block."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2021-47240", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47240\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47240\nhttps://lore.kernel.org/linux-cve-announce/2024052141-CVE-2021-47240-b6f9@gregkh/T"], "statement": "None of the products shipped by Red Hat are affected by this vulnerability.", "threat_severity": "Moderate", "upstream_fix": "kernel 4.19.196, kernel 5.4.128, kernel 5.10.46, kernel 5.12.13, kernel 5.13"}