CVE-2021-47172
Vulnerability from cvelistv5
Published
2024-03-25 09:16
Modified
2024-11-06 15:29
Severity ?
EPSS score ?
Summary
iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-47172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-17T17:18:44.850824Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T15:29:32.072Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:24:40.144Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/f49149964d2423fb618fb6b755bb1eaa431cca2c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/f70122825076117787b91e7f219e21c09f11a5b9"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/26da8040eccc6c6b0e415e9a3baf72fd39eb2fdc"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/f2a772c51206b0c3f262e4f6a3812c89a650191b"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/ad7124.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f49149964d24",
"status": "affected",
"version": "5408cbc63373",
"versionType": "git"
},
{
"lessThan": "f70122825076",
"status": "affected",
"version": "d7857e4ee1ba",
"versionType": "git"
},
{
"lessThan": "26da8040eccc",
"status": "affected",
"version": "d7857e4ee1ba",
"versionType": "git"
},
{
"lessThan": "f2a772c51206",
"status": "affected",
"version": "d7857e4ee1ba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/ad7124.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.124",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.12.*",
"status": "unaffected",
"version": "5.12.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad7124: Fix potential overflow due to non sequential channel numbers\n\nChannel numbering must start at 0 and then not have any holes, or\nit is possible to overflow the available storage. Note this bug was\nintroduced as part of a fix to ensure we didn\u0027t rely on the ordering\nof child nodes. So we need to support arbitrary ordering but they all\nneed to be there somewhere.\n\nNote I hit this when using qemu to test the rest of this series.\nArguably this isn\u0027t the best fix, but it is probably the most minimal\noption for backporting etc.\n\nAlexandru\u0027s sign-off is here because he carried this patch in a larger\nset that Jonathan then applied."
}
],
"providerMetadata": {
"dateUpdated": "2024-11-04T12:00:48.684Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f49149964d2423fb618fb6b755bb1eaa431cca2c"
},
{
"url": "https://git.kernel.org/stable/c/f70122825076117787b91e7f219e21c09f11a5b9"
},
{
"url": "https://git.kernel.org/stable/c/26da8040eccc6c6b0e415e9a3baf72fd39eb2fdc"
},
{
"url": "https://git.kernel.org/stable/c/f2a772c51206b0c3f262e4f6a3812c89a650191b"
}
],
"title": "iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers",
"x_generator": {
"engine": "bippy-9e1c9544281a"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47172",
"datePublished": "2024-03-25T09:16:23.741Z",
"dateReserved": "2024-03-25T09:12:14.111Z",
"dateUpdated": "2024-11-06T15:29:32.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2021-47172\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-25T10:15:08.967\",\"lastModified\":\"2024-11-06T16:35:01.133\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niio: adc: ad7124: Fix potential overflow due to non sequential channel numbers\\n\\nChannel numbering must start at 0 and then not have any holes, or\\nit is possible to overflow the available storage. Note this bug was\\nintroduced as part of a fix to ensure we didn\u0027t rely on the ordering\\nof child nodes. So we need to support arbitrary ordering but they all\\nneed to be there somewhere.\\n\\nNote I hit this when using qemu to test the rest of this series.\\nArguably this isn\u0027t the best fix, but it is probably the most minimal\\noption for backporting etc.\\n\\nAlexandru\u0027s sign-off is here because he carried this patch in a larger\\nset that Jonathan then applied.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: iio: adc: ad7124: Se corrige posible desbordamiento por n\u00fameros de canales no secuenciales. La numeraci\u00f3n de canales debe comenzar en 0 y luego no tener huecos, o es posible que se desborde el almacenamiento disponible. Tenga en cuenta que este error se introdujo como parte de una soluci\u00f3n para garantizar que no dependi\u00e9ramos del orden de los nodos secundarios. Por lo tanto, debemos apoyar el ordenamiento arbitrario, pero todos deben estar ah\u00ed en alguna parte. Tenga en cuenta que presion\u00e9 esto cuando uso qemu para probar el resto de esta serie. Podr\u00eda decirse que esta no es la mejor soluci\u00f3n, pero probablemente sea la opci\u00f3n m\u00e1s m\u00ednima para realizar backporting, etc. La aprobaci\u00f3n de Alexandru est\u00e1 aqu\u00ed porque llev\u00f3 este parche en un conjunto m\u00e1s grande que luego aplic\u00f3 Jonathan.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/26da8040eccc6c6b0e415e9a3baf72fd39eb2fdc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f2a772c51206b0c3f262e4f6a3812c89a650191b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f49149964d2423fb618fb6b755bb1eaa431cca2c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f70122825076117787b91e7f219e21c09f11a5b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.