CVE-2021-47509 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Limit the period size to 16MB Set the practical limit to the period size (the fragment shift in OSS) instead of a full 31bit; a too large value could lead to the exhaust of memory as we allocate temporary buffers of the period size, too. As of this patch, we set to 16MB limit, which should cover all use cases.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/2e54cf6794bf82a54aaefc78da13819aea9cd28a
https://git.kernel.org/stable/c/35a3e511032146941085f87dd9fb5b82ea5c00a2
https://git.kernel.org/stable/c/76f19e4cbb548e28547f8c328aa0bfb3a10222d3
https://git.kernel.org/stable/c/8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2
https://git.kernel.org/stable/c/ad45babf7886e7a212ee1d5eda9ef49f696db43c
https://git.kernel.org/stable/c/b02a41eebcc36d4f07196780f2e165ca2c499257
https://git.kernel.org/stable/c/be55f306396cd62c6889286a7194fd8b53363aeb
https://git.kernel.org/stable/c/d1bb703ad050de9095f10b2d3416c32921ac6bcc
https://lore.kernel.org/linux-cve-announce/2024052429-CVE-2021-47509-a210@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2021-47509
https://www.cve.org/CVERecord?id=CVE-2021-47509

History

Mon, 04 Nov 2024 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-24T15:09:25.349Z

Updated: 2024-12-19T07:43:50.028Z

Reserved: 2024-05-24T15:02:54.823Z

Link: CVE-2021-47509

Vulnrichment

Updated: 2024-08-04T05:39:59.773Z

NVD

Status : Awaiting Analysis

Published: 2024-05-24T15:15:11.780

Modified: 2024-11-21T06:36:23.717

Link: CVE-2021-47509

Redhat

Severity : Low

Publid Date: 2024-05-24T00:00:00Z

Links: CVE-2021-47509 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47509", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-24T15:02:54.823Z", "datePublished": "2024-05-24T15:09:25.349Z", "dateUpdated": "2024-12-19T07:43:50.028Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T07:43:50.028Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Limit the period size to 16MB\n\nSet the practical limit to the period size (the fragment shift in OSS)\ninstead of a full 31bit; a too large value could lead to the exhaust\nof memory as we allocate temporary buffers of the period size, too.\n\nAs of this patch, we set to 16MB limit, which should cover all use\ncases."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/core/oss/pcm_oss.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d1bb703ad050de9095f10b2d3416c32921ac6bcc", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b02a41eebcc36d4f07196780f2e165ca2c499257", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "be55f306396cd62c6889286a7194fd8b53363aeb", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2e54cf6794bf82a54aaefc78da13819aea9cd28a", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "76f19e4cbb548e28547f8c328aa0bfb3a10222d3", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ad45babf7886e7a212ee1d5eda9ef49f696db43c", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "35a3e511032146941085f87dd9fb5b82ea5c00a2", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/core/oss/pcm_oss.c"], "versions": [{"version": "4.4.295", "lessThanOrEqual": "4.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.293", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.258", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.221", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.165", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.85", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.8", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/d1bb703ad050de9095f10b2d3416c32921ac6bcc"}, {"url": "https://git.kernel.org/stable/c/b02a41eebcc36d4f07196780f2e165ca2c499257"}, {"url": "https://git.kernel.org/stable/c/be55f306396cd62c6889286a7194fd8b53363aeb"}, {"url": "https://git.kernel.org/stable/c/2e54cf6794bf82a54aaefc78da13819aea9cd28a"}, {"url": "https://git.kernel.org/stable/c/76f19e4cbb548e28547f8c328aa0bfb3a10222d3"}, {"url": "https://git.kernel.org/stable/c/ad45babf7886e7a212ee1d5eda9ef49f696db43c"}, {"url": "https://git.kernel.org/stable/c/35a3e511032146941085f87dd9fb5b82ea5c00a2"}, {"url": "https://git.kernel.org/stable/c/8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2"}], "title": "ALSA: pcm: oss: Limit the period size to 16MB", "x_generator": {"engine": "bippy-5f407fcff5a0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-29T17:05:25.970699Z", "id": "CVE-2021-47509", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T17:32:21.679Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.773Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/d1bb703ad050de9095f10b2d3416c32921ac6bcc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b02a41eebcc36d4f07196780f2e165ca2c499257", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/be55f306396cd62c6889286a7194fd8b53363aeb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2e54cf6794bf82a54aaefc78da13819aea9cd28a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/76f19e4cbb548e28547f8c328aa0bfb3a10222d3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad45babf7886e7a212ee1d5eda9ef49f696db43c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/35a3e511032146941085f87dd9fb5b82ea5c00a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/d1bb703ad050de9095f10b2d3416c32921ac6bcc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b02a41eebcc36d4f07196780f2e165ca2c499257", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/be55f306396cd62c6889286a7194fd8b53363aeb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2e54cf6794bf82a54aaefc78da13819aea9cd28a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/76f19e4cbb548e28547f8c328aa0bfb3a10222d3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad45babf7886e7a212ee1d5eda9ef49f696db43c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/35a3e511032146941085f87dd9fb5b82ea5c00a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.773Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-47509", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-29T17:05:25.970699Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-29T17:02:56.616Z"}}], "cna": {"title": "ALSA: pcm: oss: Limit the period size to 16MB", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "d1bb703ad050", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "b02a41eebcc3", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "be55f306396c", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "2e54cf6794bf", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "76f19e4cbb54", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "ad45babf7886", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "35a3e5110321", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "8839c8c0f77a", "versionType": "git"}], "programFiles": ["sound/core/oss/pcm_oss.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "4.4.295", "versionType": "semver", "lessThanOrEqual": "4.4.*"}, {"status": "unaffected", "version": "4.9.293", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.258", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.221", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.165", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.85", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.8", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/core/oss/pcm_oss.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d1bb703ad050de9095f10b2d3416c32921ac6bcc"}, {"url": "https://git.kernel.org/stable/c/b02a41eebcc36d4f07196780f2e165ca2c499257"}, {"url": "https://git.kernel.org/stable/c/be55f306396cd62c6889286a7194fd8b53363aeb"}, {"url": "https://git.kernel.org/stable/c/2e54cf6794bf82a54aaefc78da13819aea9cd28a"}, {"url": "https://git.kernel.org/stable/c/76f19e4cbb548e28547f8c328aa0bfb3a10222d3"}, {"url": "https://git.kernel.org/stable/c/ad45babf7886e7a212ee1d5eda9ef49f696db43c"}, {"url": "https://git.kernel.org/stable/c/35a3e511032146941085f87dd9fb5b82ea5c00a2"}, {"url": "https://git.kernel.org/stable/c/8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Limit the period size to 16MB\n\nSet the practical limit to the period size (the fragment shift in OSS)\ninstead of a full 31bit; a too large value could lead to the exhaust\nof memory as we allocate temporary buffers of the period size, too.\n\nAs of this patch, we set to 16MB limit, which should cover all use\ncases."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:07:18.283Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47509", "state": "PUBLISHED", "dateUpdated": "2024-11-07T17:32:21.679Z", "dateReserved": "2024-05-24T15:02:54.823Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-24T15:09:25.349Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Limit the period size to 16MB\n\nSet the practical limit to the period size (the fragment shift in OSS)\ninstead of a full 31bit; a too large value could lead to the exhaust\nof memory as we allocate temporary buffers of the period size, too.\n\nAs of this patch, we set to 16MB limit, which should cover all use\ncases."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: pcm: oss: Limitar el tama\u00f1o del per\u00edodo a 16 MB Establezca el l\u00edmite pr\u00e1ctico para el tama\u00f1o del per\u00edodo (el desplazamiento de fragmentos en OSS) en lugar de 31 bits completos; un valor demasiado grande podr\u00eda provocar el agotamiento de la memoria, ya que tambi\u00e9n asignamos b\u00faferes temporales del tama\u00f1o del per\u00edodo. A partir de este parche, establecimos un l\u00edmite de 16 MB, que deber\u00eda cubrir todos los casos de uso."}], "id": "CVE-2021-47509", "lastModified": "2024-11-21T06:36:23.717", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-05-24T15:15:11.780", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e54cf6794bf82a54aaefc78da13819aea9cd28a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/35a3e511032146941085f87dd9fb5b82ea5c00a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/76f19e4cbb548e28547f8c328aa0bfb3a10222d3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ad45babf7886e7a212ee1d5eda9ef49f696db43c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b02a41eebcc36d4f07196780f2e165ca2c499257"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be55f306396cd62c6889286a7194fd8b53363aeb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d1bb703ad050de9095f10b2d3416c32921ac6bcc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/2e54cf6794bf82a54aaefc78da13819aea9cd28a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/35a3e511032146941085f87dd9fb5b82ea5c00a2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/76f19e4cbb548e28547f8c328aa0bfb3a10222d3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/ad45babf7886e7a212ee1d5eda9ef49f696db43c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/b02a41eebcc36d4f07196780f2e165ca2c499257"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/be55f306396cd62c6889286a7194fd8b53363aeb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/d1bb703ad050de9095f10b2d3416c32921ac6bcc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}