CVE-2021-47636
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-47636
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-47636.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-47636
- Related
- Published
- 2025-02-26T06:37:05Z
- Modified
- 2025-03-18T20:50:25.082939Z
- Downstream
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ubifs: Fix read out-of-bounds in ubifswbufwrite_nolock()
Function ubifswbufwrite_nolock() may access buf out of bounds in following process:
ubifswbufwritenolock(): alignedlen = ALIGN(len, 8); // Assume len = 4089, alignedlen = 4096 if (alignedlen <= wbuf->avail) ... // Not satisfy if (wbuf->used) { ubifslebwrite() // Fill some data in avail wbuf len -= wbuf->avail; // len is still not 8-bytes aligned alignedlen -= wbuf->avail; } n = alignedlen >> c->maxwriteshift; if (n) { n <<= c->maxwriteshift; err = ubifslebwrite(c, wbuf->lnum, buf + written, wbuf->offs, n); // n > len, read out of bounds less than 8(n-len) bytes }
, which can be catched by KASAN: ========================================================= BUG: KASAN: slab-out-of-bounds in eccswhammingcalculate+0x1dc/0x7d0 Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128 Workqueue: writeback wbworkfn (flush-ubifs00) Call Trace: kasanreport.cold+0x81/0x165 nandwritepageswecc+0xa9/0x160 ubifslebwrite+0xf2/0x1b0 [ubifs] ubifswbufwritenolock+0x421/0x12c0 [ubifs] writehead+0xdc/0x1c0 [ubifs] ubifsjnlwriteinode+0x627/0x960 [ubifs] wbworkfn+0x8af/0xb80
Function ubifswbufwritenolock() accepts that parameter 'len' is not 8 bytes aligned, the 'len' represents the true length of buf (which is allocated in 'ubifsjnlxxx', eg. ubifsjnlwriteinode), so ubifswbufwrite_nolock() must handle the length read from 'buf' carefully to write leb safely.
Fetch a reproducer in [Link].
- References
-
- https://git.kernel.org/stable/c/07a209fadee7b53b46858538e1177597273862e4
- https://git.kernel.org/stable/c/3b7fb89135a20587d57f8877c02e25003e9edbdf
- https://git.kernel.org/stable/c/4f2262a334641e05f645364d5ade1f565c85f20b
- https://git.kernel.org/stable/c/5343575aa11c5d7044107d59d43f84aec01312b0
- https://git.kernel.org/stable/c/a7054aaf1909cf40489c0ec1b728fdcf79c751a6
- https://git.kernel.org/stable/c/b80ccbec0e4804436c382d7dd60e943c386ed83a
- https://git.kernel.org/stable/c/e09fa5318d51f522e1af4fbaf8f74999355980c8
- https://security-tracker.debian.org/tracker/CVE-2021-47636
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.113-1
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source