CVE-2021-47636

published 2025-02-26

CVE-2021-47636: In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() Function…

Priority P4 31 high 7.1 CVSS 3.1

AV L AC L PR L UI N S U C H I N A H

In the Linux kernel, the following vulnerability has been resolved:

ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()

Function ubifs_wbuf_write_nolock() may access buf out of bounds in
following process:

ubifs_wbuf_write_nolock():
aligned_len = ALIGN(len, 8); // Assume len = 4089, aligned_len = 4096
if (aligned_len avail) ... // Not satisfy
if (wbuf->used) {
ubifs_leb_write() // Fill some data in avail wbuf
len -= wbuf->avail; // len is still not 8-bytes aligned
aligned_len -= wbuf->avail;
}
n = aligned_len >> c->max_write_shift;
if (n) {
n max_write_shift;
err = ubifs_leb_write(c, wbuf->lnum, buf + written,
wbuf->offs, n);
// n > len, read out of bounds less than 8(n-len) bytes
}

, which can be catched by KASAN:
BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0
Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128
Workqueue: writeback wb_workfn (flush-ubifs_0_0)
Call Trace:
kasan_report.cold+0x81/0x165
nand_write_page_swecc+0xa9/0x160
ubifs_leb_write+0xf2/0x1b0 [ubifs]
ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs]
write_head+0xdc/0x1c0 [ubifs]
ubifs_jnl_write_inode+0x627/0x960 [ubifs]
wb_workfn+0x8af/0xb80

Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8
bytes aligned, the 'len' represents the true length of buf (which is
allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so
ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully
to write leb safely.

Fetch a reproducer in [Link].

Affected

19 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.17.3-1 (bookworm)	linux 5.17.3-1 (bookworm)
linux	linux	—	—
linux	linux	>= 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d < 5343575aa11c5d7044107d59d43f84aec01312b0	5343575aa11c5d7044107d59d43f84aec01312b0
linux	linux	>= 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d < b80ccbec0e4804436c382d7dd60e943c386ed83a	b80ccbec0e4804436c382d7dd60e943c386ed83a
linux	linux	>= 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d < 07a209fadee7b53b46858538e1177597273862e4	07a209fadee7b53b46858538e1177597273862e4
linux	linux	>= 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d < a7054aaf1909cf40489c0ec1b728fdcf79c751a6	a7054aaf1909cf40489c0ec1b728fdcf79c751a6
linux	linux	>= 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d < e09fa5318d51f522e1af4fbaf8f74999355980c8	e09fa5318d51f522e1af4fbaf8f74999355980c8
linux	linux	>= 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d < 3b7fb89135a20587d57f8877c02e25003e9edbdf	3b7fb89135a20587d57f8877c02e25003e9edbdf
linux	linux	>= 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d < 4f2262a334641e05f645364d5ade1f565c85f20b	4f2262a334641e05f645364d5ade1f565c85f20b
linux	linux_kernel	>= 0 < 5.10.113-1	5.10.113-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 2.6.27 < 4.19.238	4.19.238
linux	linux_kernel	>= 4.20 < 5.4.189	5.4.189
linux	linux_kernel	>= 5.11 < 5.15.33	5.15.33
linux	linux_kernel	>= 5.16 < 5.16.19	5.16.19
linux	linux_kernel	>= 5.17 < 5.17.2	5.17.2
linux	linux_kernel	>= 5.5 < 5.10.110	5.10.110

CVSS provenance

nvd v3.1 7.1 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

osv 7.1 HIGH

vendor_debian 7.1 HIGH

vendor_redhat 7.1 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-125