CVE-2021-47339 (GCVE-0-2021-47339)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2025-05-04 07:08
VLAI?
Summary
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: explicitly clear ioctl input data As seen from a recent syzbot bug report, mistakes in the compat ioctl implementation can lead to uninitialized kernel stack data getting used as input for driver ioctl handlers. The reported bug is now fixed, but it's possible that other related bugs are still present or get added in the future. As the drivers need to check user input already, the possible impact is fairly low, but it might still cause an information leak. To be on the safe side, always clear the entire ioctl buffer before calling the conversion handler functions that are meant to initialize them.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bfb48b54db25c3b4ef4bef5e0691464ebc4aa335 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7b53cca764f9b291b7907fcd39d9e66ad728ee0b (git)
Create a notification for this product.
    Linux Linux Unaffected: 5.12.18 , ≤ 5.12.* (semver)
Unaffected: 5.13.3 , ≤ 5.13.* (semver)
Unaffected: 5.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.498Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bfb48b54db25c3b4ef4bef5e0691464ebc4aa335"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7b53cca764f9b291b7907fcd39d9e66ad728ee0b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47339",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:38:53.466154Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:49.514Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/v4l2-core/v4l2-ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bfb48b54db25c3b4ef4bef5e0691464ebc4aa335",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7b53cca764f9b291b7907fcd39d9e66ad728ee0b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/v4l2-core/v4l2-ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-core: explicitly clear ioctl input data\n\nAs seen from a recent syzbot bug report, mistakes in the compat ioctl\nimplementation can lead to uninitialized kernel stack data getting used\nas input for driver ioctl handlers.\n\nThe reported bug is now fixed, but it\u0027s possible that other related\nbugs are still present or get added in the future. As the drivers need\nto check user input already, the possible impact is fairly low, but it\nmight still cause an information leak.\n\nTo be on the safe side, always clear the entire ioctl buffer before\ncalling the conversion handler functions that are meant to initialize\nthem."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:08:56.950Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfb48b54db25c3b4ef4bef5e0691464ebc4aa335"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b53cca764f9b291b7907fcd39d9e66ad728ee0b"
        }
      ],
      "title": "media: v4l2-core: explicitly clear ioctl input data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47339",
    "datePublished": "2024-05-21T14:35:47.683Z",
    "dateReserved": "2024-05-21T14:28:16.978Z",
    "dateUpdated": "2025-05-04T07:08:56.950Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: v4l2-core: explicitly clear ioctl input data\\n\\nAs seen from a recent syzbot bug report, mistakes in the compat ioctl\\nimplementation can lead to uninitialized kernel stack data getting used\\nas input for driver ioctl handlers.\\n\\nThe reported bug is now fixed, but it\u0027s possible that other related\\nbugs are still present or get added in the future. As the drivers need\\nto check user input already, the possible impact is fairly low, but it\\nmight still cause an information leak.\\n\\nTo be on the safe side, always clear the entire ioctl buffer before\\ncalling the conversion handler functions that are meant to initialize\\nthem.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: medios: v4l2-core: borrar expl\\u00edcitamente los datos de entrada de ioctl. Como se ve en un informe de error reciente de syzbot, los errores en la implementaci\\u00f3n de compat ioctl pueden llevar a que los datos de la pila del kernel no inicializados se utilicen como entrada para controladores de ioctl del conductor. El error informado ya est\\u00e1 solucionado, pero es posible que otros errores relacionados sigan presentes o se agreguen en el futuro. Como los controladores ya necesitan verificar la entrada del usuario, el posible impacto es bastante bajo, pero a\\u00fan as\\u00ed podr\\u00eda causar una fuga de informaci\\u00f3n. Para estar seguro, borre siempre todo el b\\u00fafer ioctl antes de llamar a las funciones del controlador de conversi\\u00f3n destinadas a inicializarlos.\"}]",
      "id": "CVE-2021-47339",
      "lastModified": "2024-11-21T06:35:55.093",
      "published": "2024-05-21T15:15:20.693",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/7b53cca764f9b291b7907fcd39d9e66ad728ee0b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bfb48b54db25c3b4ef4bef5e0691464ebc4aa335\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7b53cca764f9b291b7907fcd39d9e66ad728ee0b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/bfb48b54db25c3b4ef4bef5e0691464ebc4aa335\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47339\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:20.693\",\"lastModified\":\"2025-03-06T12:57:52.070\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: v4l2-core: explicitly clear ioctl input data\\n\\nAs seen from a recent syzbot bug report, mistakes in the compat ioctl\\nimplementation can lead to uninitialized kernel stack data getting used\\nas input for driver ioctl handlers.\\n\\nThe reported bug is now fixed, but it\u0027s possible that other related\\nbugs are still present or get added in the future. As the drivers need\\nto check user input already, the possible impact is fairly low, but it\\nmight still cause an information leak.\\n\\nTo be on the safe side, always clear the entire ioctl buffer before\\ncalling the conversion handler functions that are meant to initialize\\nthem.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: medios: v4l2-core: borrar expl\u00edcitamente los datos de entrada de ioctl. Como se ve en un informe de error reciente de syzbot, los errores en la implementaci\u00f3n de compat ioctl pueden llevar a que los datos de la pila del kernel no inicializados se utilicen como entrada para controladores de ioctl del conductor. El error informado ya est\u00e1 solucionado, pero es posible que otros errores relacionados sigan presentes o se agreguen en el futuro. Como los controladores ya necesitan verificar la entrada del usuario, el posible impacto es bastante bajo, pero a\u00fan as\u00ed podr\u00eda causar una fuga de informaci\u00f3n. Para estar seguro, borre siempre todo el b\u00fafer ioctl antes de llamar a las funciones del controlador de conversi\u00f3n destinadas a inicializarlos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.12.18\",\"matchCriteriaId\":\"921ECC8D-5569-4A2C-ABD6-C7747BC6A7CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"5.13.3\",\"matchCriteriaId\":\"853187F6-707A-487B-95C0-621B5211B43C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7b53cca764f9b291b7907fcd39d9e66ad728ee0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfb48b54db25c3b4ef4bef5e0691464ebc4aa335\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7b53cca764f9b291b7907fcd39d9e66ad728ee0b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfb48b54db25c3b4ef4bef5e0691464ebc4aa335\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bfb48b54db25c3b4ef4bef5e0691464ebc4aa335\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7b53cca764f9b291b7907fcd39d9e66ad728ee0b\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.498Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47339\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:38:53.466154Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:18.970Z\"}}], \"cna\": {\"title\": \"media: v4l2-core: explicitly clear ioctl input data\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"bfb48b54db25c3b4ef4bef5e0691464ebc4aa335\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"7b53cca764f9b291b7907fcd39d9e66ad728ee0b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/media/v4l2-core/v4l2-ioctl.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.12.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.13.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/media/v4l2-core/v4l2-ioctl.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8\"}, {\"url\": \"https://git.kernel.org/stable/c/bfb48b54db25c3b4ef4bef5e0691464ebc4aa335\"}, {\"url\": \"https://git.kernel.org/stable/c/7b53cca764f9b291b7907fcd39d9e66ad728ee0b\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: v4l2-core: explicitly clear ioctl input data\\n\\nAs seen from a recent syzbot bug report, mistakes in the compat ioctl\\nimplementation can lead to uninitialized kernel stack data getting used\\nas input for driver ioctl handlers.\\n\\nThe reported bug is now fixed, but it\u0027s possible that other related\\nbugs are still present or get added in the future. As the drivers need\\nto check user input already, the possible impact is fairly low, but it\\nmight still cause an information leak.\\n\\nTo be on the safe side, always clear the entire ioctl buffer before\\ncalling the conversion handler functions that are meant to initialize\\nthem.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T07:40:02.041Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47339\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T07:40:02.041Z\", \"dateReserved\": \"2024-05-21T14:28:16.978Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:35:47.683Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.