CVE-2021-47604

published 2024-06-19

CVE-2021-47604: In the Linux kernel, the following vulnerability has been resolved: vduse: check that offset is within bounds in get_config() This condition checks "len" but…

Priority P4 30 high 7.1 CVSS 3.1

AV L AC L PR L UI N S U C H I N A H

In the Linux kernel, the following vulnerability has been resolved:

vduse: check that offset is within bounds in get_config()

This condition checks "len" but it does not check "offset" and that
could result in an out of bounds read if "offset > dev->config_size".
The problem is that since both variables are unsigned the
"dev->config_size - offset" subtraction would result in a very high
unsigned value.

I think these checks might not be necessary because "len" and "offset"
are supposed to already have been validated using the
vhost_vdpa_config_validate() function. But I do not know the code
perfectly, and I like to be safe.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.15.15-1 (bookworm)	linux 5.15.15-1 (bookworm)
linux	linux	—	—
linux	linux	>= c8a6153b6c59d95c0e091f053f6f180952ade91e < ebbbc5fea3f648175df1aa3f127c78eb0252cc2a	ebbbc5fea3f648175df1aa3f127c78eb0252cc2a
linux	linux	>= c8a6153b6c59d95c0e091f053f6f180952ade91e < dc1db0060c02d119fd4196924eff2d1129e9a442	dc1db0060c02d119fd4196924eff2d1129e9a442
linux	linux_kernel	>= 0 < 5.15.15-1	5.15.15-1
linux	linux_kernel	>= 0 < 5.15.15-1	5.15.15-1
linux	linux_kernel	>= 0 < 5.15.15-1	5.15.15-1
linux	linux_kernel	>= 5.15 < 5.15.11	5.15.11

CVSS provenance

nvd v3.1 7.1 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

osv 7.1 HIGH

vendor_debian 7.1 HIGH

vendor_redhat 7.1 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-125