In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Fix string overflow in SCPI genpd driver Without the bound checks for scpi_pd->name, it could result in the buffer overflow when copying the SCPI device name from the corresponding device tree node as the name string is set at maximum size of 30. Let us fix it by using devm_kasprintf so that the string buffer is allocated dynamically.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel
Redhat
  • Enterprise Linux

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
kernel-rt-0:4.18.0-553.22.1.rt7.363.el8_10 cpe:/a:redhat:enterprise_linux:8::nfv RHSA-2024:7001 2024-09-24T00:00:00Z
kernel-0:4.18.0-553.22.1.el8_10 cpe:/o:redhat:enterprise_linux:8 RHSA-2024:7000 2024-09-24T00:00:00Z
References
Link Providers
https://git.kernel.org/stable/c/4694b1ec425a2d20d6f8ca3db594829fdf5f2672 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/639901b9429a3195e0fead981ed74b51f5f31538 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/7e8645ca2c0046f7cd2f0f7d569fc036c8abaedb cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/802a1a8501563714a5fe8824f4ed27fec04a0719 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/865ed67ab955428b9aa771d8b4f1e4fb7fd08945 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/976389cbb16cee46847e5d06250a3a0b5506781e cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/f0f484714f35d24ffa0ecb4afe3df1c5b225411d cve-icon cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024061907-CVE-2021-47609-5ebf@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47609 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47609 cve-icon
History

Wed, 30 Oct 2024 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-120
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 24 Sep 2024 11:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8

Tue, 24 Sep 2024 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:8::nfv
Vendors & Products Redhat
Redhat enterprise Linux

Thu, 12 Sep 2024 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-06-19T14:57:59.001Z

Updated: 2024-11-04T12:09:06.503Z

Reserved: 2024-06-19T14:55:32.794Z

Link: CVE-2021-47609

cve-icon Vulnrichment

Updated: 2024-08-04T05:47:40.258Z

cve-icon NVD

Status : Analyzed

Published: 2024-06-19T15:15:55.457

Modified: 2024-10-30T21:31:54.493

Link: CVE-2021-47609

cve-icon Redhat

Severity : Low

Publid Date: 2024-06-19T00:00:00Z

Links: CVE-2021-47609 - Bugzilla