CVE-2021-47191 (GCVE-0-2021-47191)

Vulnerability from cvelistv5 – Published: 2024-04-10 18:56 – Updated: 2026-08-05 08:46
VLAI
Title
scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() The following warning was observed running syzkaller: [ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724] program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] fill_from_dev_buffer+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0 [ 3813.862699] scsi_dispatch_cmd+0x330/0x950 [ 3813.863329] scsi_request_fn+0xd8e/0x1710 [ 3813.863946] __blk_run_queue+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9 This issue can be reproduced with the following syzkaller log: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126) In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This leads to OOB in sg_copy_buffer(). To solve this issue, define alloc_len as u32.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-17 18:03 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c65b1445d153a66ca91b00c1f10187e495c17918 , < 3e20cb072679bdb47747ccc8bee3233a4cf0765a (git)
Affected: c65b1445d153a66ca91b00c1f10187e495c17918 , < 5b8bed6464ad6653586e30df046185fd816ad999 (git)
Affected: c65b1445d153a66ca91b00c1f10187e495c17918 , < 4e3ace0051e7e504b55d239daab8789dd89b863c (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.18
Unaffected: 0 , < 2.6.18 (semver)
Unaffected: 5.10.82 , ≤ 5.10.* (semver)
Unaffected: 5.15.5 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47191",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T18:03:54.717932Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T18:04:58.134Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.284Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3e20cb072679bdb47747ccc8bee3233a4cf0765a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5b8bed6464ad6653586e30df046185fd816ad999"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4e3ace0051e7e504b55d239daab8789dd89b863c"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e20cb072679bdb47747ccc8bee3233a4cf0765a",
              "status": "affected",
              "version": "c65b1445d153a66ca91b00c1f10187e495c17918",
              "versionType": "git"
            },
            {
              "lessThan": "5b8bed6464ad6653586e30df046185fd816ad999",
              "status": "affected",
              "version": "c65b1445d153a66ca91b00c1f10187e495c17918",
              "versionType": "git"
            },
            {
              "lessThan": "4e3ace0051e7e504b55d239daab8789dd89b863c",
              "status": "affected",
              "version": "c65b1445d153a66ca91b00c1f10187e495c17918",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.82",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix out-of-bound read in resp_readcap16()\n\nThe following warning was observed running syzkaller:\n\n[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in;\n[ 3813.830724]    program syz-executor not setting count and/or reply_len properly\n[ 3813.836956] ==================================================================\n[ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0\n[ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549\n[ 3813.846612] Call Trace:\n[ 3813.846995]  dump_stack+0x108/0x15f\n[ 3813.847524]  print_address_description+0xa5/0x372\n[ 3813.848243]  kasan_report.cold+0x236/0x2a8\n[ 3813.849439]  check_memory_region+0x240/0x270\n[ 3813.850094]  memcpy+0x30/0x80\n[ 3813.850553]  sg_copy_buffer+0x157/0x1e0\n[ 3813.853032]  sg_copy_from_buffer+0x13/0x20\n[ 3813.853660]  fill_from_dev_buffer+0x135/0x370\n[ 3813.854329]  resp_readcap16+0x1ac/0x280\n[ 3813.856917]  schedule_resp+0x41f/0x1630\n[ 3813.858203]  scsi_debug_queuecommand+0xb32/0x17e0\n[ 3813.862699]  scsi_dispatch_cmd+0x330/0x950\n[ 3813.863329]  scsi_request_fn+0xd8e/0x1710\n[ 3813.863946]  __blk_run_queue+0x10b/0x230\n[ 3813.864544]  blk_execute_rq_nowait+0x1d8/0x400\n[ 3813.865220]  sg_common_write.isra.0+0xe61/0x2420\n[ 3813.871637]  sg_write+0x6c8/0xef0\n[ 3813.878853]  __vfs_write+0xe4/0x800\n[ 3813.883487]  vfs_write+0x17b/0x530\n[ 3813.884008]  ksys_write+0x103/0x270\n[ 3813.886268]  __x64_sys_write+0x77/0xc0\n[ 3813.886841]  do_syscall_64+0x106/0x360\n[ 3813.887415]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nThis issue can be reproduced with the following syzkaller log:\n\nr0 = openat(0xffffffffffffff9c, \u0026(0x7f0000000040)=\u0027./file0\\x00\u0027, 0x26e1, 0x0)\nr1 = syz_open_procfs(0xffffffffffffffff, \u0026(0x7f0000000000)=\u0027fd/3\\x00\u0027)\nopen_by_handle_at(r1, \u0026(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000)\nr2 = syz_open_dev$sg(\u0026(0x7f0000000000), 0x0, 0x40782)\nwrite$binfmt_aout(r2, \u0026(0x7f0000000340)=ANY=[@ANYBLOB=\"00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d\"], 0x126)\n\nIn resp_readcap16() we get \"int alloc_len\" value -1104926854, and then pass\nthe huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This\nleads to OOB in sg_copy_buffer().\n\nTo solve this issue, define alloc_len as u32."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by issuing a SCSI READ CAPACITY(16) CDB via write/ioctl on /dev/sg (or SG_IO on the scsi_debug block device), which is a local syscall path, not a network-facing protocol handler.\nAC:L - An attacker who can open the scsi_debug sg device can reliably trigger the OOB by setting the allocation length field with the high bit set; no race or other attacker-uncontrolled condition is required.\nPR:L - SERVICE_ACTION_IN_16 (0x9e) is on the unprivileged scsi_cmd_allowed allowlist, so CAP_SYS_RAWIO is not required; access only needs open permission on /dev/sg*, typically via membership in the disk group.\nUI:N - The attacker opens the device and sends the crafted SCSI command themselves; no separate victim action is required.\nS:U - This is a host-kernel memory-safety bug in the scsi_debug simulator with impact confined to the same privilege domain; it does not cross a VM, IOMMU, or other security authority boundary.\nC:H - A signed min_t() miscomparison turns a attacker-controlled allocation length into a huge size_t, causing fill_from_dev_buffer()/sg_copy_from_buffer() to read far past the 32-byte stack array and return that kernel stack memory to userspace via the SCSI data-in buffer.\nI:N - The corruption is a stack out-of-bounds read into the response buffer only; there is no out-of-bounds write or other integrity-modifying primitive.\nA:H - The unbounded stack OOB read can fault into unmapped memory and produce a kernel oops/panic, matching the KASAN-detected crash path in the report."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:37.004Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e20cb072679bdb47747ccc8bee3233a4cf0765a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b8bed6464ad6653586e30df046185fd816ad999"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e3ace0051e7e504b55d239daab8789dd89b863c"
        }
      ],
      "title": "scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47191",
    "datePublished": "2024-04-10T18:56:29.455Z",
    "dateReserved": "2024-03-25T09:12:14.113Z",
    "dateUpdated": "2026-08-05T08:46:37.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47191",
      "date": "2026-09-27",
      "epss": "0.00236",
      "percentile": "0.1313"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix out-of-bound read in resp_readcap16()\n\nThe following warning was observed running syzkaller:\n\n[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in;\n[ 3813.830724]    program syz-executor not setting count and/or reply_len properly\n[ 3813.836956] ==================================================================\n[ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0\n[ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549\n[ 3813.846612] Call Trace:\n[ 3813.846995]  dump_stack+0x108/0x15f\n[ 3813.847524]  print_address_description+0xa5/0x372\n[ 3813.848243]  kasan_report.cold+0x236/0x2a8\n[ 3813.849439]  check_memory_region+0x240/0x270\n[ 3813.850094]  memcpy+0x30/0x80\n[ 3813.850553]  sg_copy_buffer+0x157/0x1e0\n[ 3813.853032]  sg_copy_from_buffer+0x13/0x20\n[ 3813.853660]  fill_from_dev_buffer+0x135/0x370\n[ 3813.854329]  resp_readcap16+0x1ac/0x280\n[ 3813.856917]  schedule_resp+0x41f/0x1630\n[ 3813.858203]  scsi_debug_queuecommand+0xb32/0x17e0\n[ 3813.862699]  scsi_dispatch_cmd+0x330/0x950\n[ 3813.863329]  scsi_request_fn+0xd8e/0x1710\n[ 3813.863946]  __blk_run_queue+0x10b/0x230\n[ 3813.864544]  blk_execute_rq_nowait+0x1d8/0x400\n[ 3813.865220]  sg_common_write.isra.0+0xe61/0x2420\n[ 3813.871637]  sg_write+0x6c8/0xef0\n[ 3813.878853]  __vfs_write+0xe4/0x800\n[ 3813.883487]  vfs_write+0x17b/0x530\n[ 3813.884008]  ksys_write+0x103/0x270\n[ 3813.886268]  __x64_sys_write+0x77/0xc0\n[ 3813.886841]  do_syscall_64+0x106/0x360\n[ 3813.887415]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nThis issue can be reproduced with the following syzkaller log:\n\nr0 = openat(0xffffffffffffff9c, \u0026(0x7f0000000040)=\u0027./file0\\x00\u0027, 0x26e1, 0x0)\nr1 = syz_open_procfs(0xffffffffffffffff, \u0026(0x7f0000000000)=\u0027fd/3\\x00\u0027)\nopen_by_handle_at(r1, \u0026(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000)\nr2 = syz_open_dev$sg(\u0026(0x7f0000000000), 0x0, 0x40782)\nwrite$binfmt_aout(r2, \u0026(0x7f0000000340)=ANY=[@ANYBLOB=\"00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d\"], 0x126)\n\nIn resp_readcap16() we get \"int alloc_len\" value -1104926854, and then pass\nthe huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This\nleads to OOB in sg_copy_buffer().\n\nTo solve this issue, define alloc_len as u32."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: scsi_debug: Se corrige la lectura fuera de los l\u00edmites en resp_readcap16(). Se observ\u00f3 la siguiente advertencia al ejecutar syzkaller: [ 3813.830724] sg_write: datos de entrada/salida 65466/242 bytes para el comando SCSI 0x9e-- adivinando datos de entrada; [ 3813.830724] El programa syz-executor no establece count y/o reply_len correctamente [ 3813.836956] ====================================================================== [ 3813.839465] ERROR: KASAN: pila fuera de los l\u00edmites en sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Lectura de tama\u00f1o 4096 en la direcci\u00f3n ffff8883cf80f540 por la tarea syz-executor/1549 [ 3813.846612] Seguimiento de llamadas: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] llenar_desde_buffer_dev+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] comando_cola_de_depuraci\u00f3n_scsi+0xb32/0x17e0 [ 3813.862699] comando_env\u00edo_scsi+0x330/0x950 [ 3813.863329] funci\u00f3n_solicitud_scsi+0xd8e/0x1710 [ 3813.863946] cola_ejecuci\u00f3n_blk+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Este problema se puede reproducir con el siguiente registro de syzkaller: r0 = openat(0xffffffffffffff9c, \u0026amp;(0x7f0000000040)=\u0027./file0\\x00\u0027, 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, \u0026amp;(0x7f0000000000)=\u0027fd/3\\x00\u0027) open_by_handle_at(r1, \u0026amp;(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(\u0026amp;(0x7f0000000000), 0x0, 0x40782) escribir$binfmt_aout(r2, \u0026amp;(0x7f0000000340)=ANY=[@ANYBLOB=\"00000000deff000000000000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d\"], 0x126) En resp_readcap16() obtenemos el valor \"int alloc_len\" -1104926854, y luego pasamos la enorme arr_len se usa para fill_from_dev_buffer(), pero arr solo tiene 32 bytes. Esto genera OOB en sg_copy_buffer(). Para resolver este problema, defina alloc_len como u32."
        }
      ],
      "id": "CVE-2021-47191",
      "lastModified": "2024-11-21T06:35:35.783",
      "published": "2024-04-10T19:15:47.663",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/3e20cb072679bdb47747ccc8bee3233a4cf0765a"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/4e3ace0051e7e504b55d239daab8789dd89b863c"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/5b8bed6464ad6653586e30df046185fd816ad999"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/3e20cb072679bdb47747ccc8bee3233a4cf0765a"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/4e3ace0051e7e504b55d239daab8789dd89b863c"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/5b8bed6464ad6653586e30df046185fd816ad999"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/scsi_debug.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3e20cb072679bdb47747ccc8bee3233a4cf0765a",
                    "status": "affected",
                    "version": "c65b1445d153a66ca91b00c1f10187e495c17918",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5b8bed6464ad6653586e30df046185fd816ad999",
                    "status": "affected",
                    "version": "c65b1445d153a66ca91b00c1f10187e495c17918",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4e3ace0051e7e504b55d239daab8789dd89b863c",
                    "status": "affected",
                    "version": "c65b1445d153a66ca91b00c1f10187e495c17918",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/scsi_debug.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.18"
                  },
                  {
                    "lessThan": "2.6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.82",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "49103CD7-A3F7-441A-AAF4-11B8B707979D",
                    "versionEndExcluding": "5.10.82",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2128A085-4C0C-4C1E-9E9C-0DD868E2170F",
                    "versionEndExcluding": "5.15.5",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix out-of-bound read in resp_readcap16()\n\nThe following warning was observed running syzkaller:\n\n[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in;\n[ 3813.830724]    program syz-executor not setting count and/or reply_len properly\n[ 3813.836956] ==================================================================\n[ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0\n[ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549\n[ 3813.846612] Call Trace:\n[ 3813.846995]  dump_stack+0x108/0x15f\n[ 3813.847524]  print_address_description+0xa5/0x372\n[ 3813.848243]  kasan_report.cold+0x236/0x2a8\n[ 3813.849439]  check_memory_region+0x240/0x270\n[ 3813.850094]  memcpy+0x30/0x80\n[ 3813.850553]  sg_copy_buffer+0x157/0x1e0\n[ 3813.853032]  sg_copy_from_buffer+0x13/0x20\n[ 3813.853660]  fill_from_dev_buffer+0x135/0x370\n[ 3813.854329]  resp_readcap16+0x1ac/0x280\n[ 3813.856917]  schedule_resp+0x41f/0x1630\n[ 3813.858203]  scsi_debug_queuecommand+0xb32/0x17e0\n[ 3813.862699]  scsi_dispatch_cmd+0x330/0x950\n[ 3813.863329]  scsi_request_fn+0xd8e/0x1710\n[ 3813.863946]  __blk_run_queue+0x10b/0x230\n[ 3813.864544]  blk_execute_rq_nowait+0x1d8/0x400\n[ 3813.865220]  sg_common_write.isra.0+0xe61/0x2420\n[ 3813.871637]  sg_write+0x6c8/0xef0\n[ 3813.878853]  __vfs_write+0xe4/0x800\n[ 3813.883487]  vfs_write+0x17b/0x530\n[ 3813.884008]  ksys_write+0x103/0x270\n[ 3813.886268]  __x64_sys_write+0x77/0xc0\n[ 3813.886841]  do_syscall_64+0x106/0x360\n[ 3813.887415]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nThis issue can be reproduced with the following syzkaller log:\n\nr0 = openat(0xffffffffffffff9c, \u0026(0x7f0000000040)=\u0027./file0\\x00\u0027, 0x26e1, 0x0)\nr1 = syz_open_procfs(0xffffffffffffffff, \u0026(0x7f0000000000)=\u0027fd/3\\x00\u0027)\nopen_by_handle_at(r1, \u0026(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000)\nr2 = syz_open_dev$sg(\u0026(0x7f0000000000), 0x0, 0x40782)\nwrite$binfmt_aout(r2, \u0026(0x7f0000000340)=ANY=[@ANYBLOB=\"00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d\"], 0x126)\n\nIn resp_readcap16() we get \"int alloc_len\" value -1104926854, and then pass\nthe huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This\nleads to OOB in sg_copy_buffer().\n\nTo solve this issue, define alloc_len as u32."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: scsi_debug: Se corrige la lectura fuera de los l\u00edmites en resp_readcap16(). Se observ\u00f3 la siguiente advertencia al ejecutar syzkaller: [ 3813.830724] sg_write: datos de entrada/salida 65466/242 bytes para el comando SCSI 0x9e-- adivinando datos de entrada; [ 3813.830724] El programa syz-executor no establece count y/o reply_len correctamente [ 3813.836956] ====================================================================== [ 3813.839465] ERROR: KASAN: pila fuera de los l\u00edmites en sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Lectura de tama\u00f1o 4096 en la direcci\u00f3n ffff8883cf80f540 por la tarea syz-executor/1549 [ 3813.846612] Seguimiento de llamadas: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] llenar_desde_buffer_dev+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] comando_cola_de_depuraci\u00f3n_scsi+0xb32/0x17e0 [ 3813.862699] comando_env\u00edo_scsi+0x330/0x950 [ 3813.863329] funci\u00f3n_solicitud_scsi+0xd8e/0x1710 [ 3813.863946] cola_ejecuci\u00f3n_blk+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Este problema se puede reproducir con el siguiente registro de syzkaller: r0 = openat(0xffffffffffffff9c, \u0026amp;(0x7f0000000040)=\u0027./file0\\x00\u0027, 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, \u0026amp;(0x7f0000000000)=\u0027fd/3\\x00\u0027) open_by_handle_at(r1, \u0026amp;(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(\u0026amp;(0x7f0000000000), 0x0, 0x40782) escribir$binfmt_aout(r2, \u0026amp;(0x7f0000000340)=ANY=[@ANYBLOB=\"00000000deff000000000000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d\"], 0x126) En resp_readcap16() obtenemos el valor \"int alloc_len\" -1104926854, y luego pasamos la enorme arr_len se usa para fill_from_dev_buffer(), pero arr solo tiene 32 bytes. Esto genera OOB en sg_copy_buffer(). Para resolver este problema, defina alloc_len como u32."
          }
        ],
        "id": "CVE-2021-47191",
        "lastModified": "2026-08-04T10:16:51.587",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47191",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T18:03:54.717932Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-10T19:15:47.663",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3e20cb072679bdb47747ccc8bee3233a4cf0765a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4e3ace0051e7e504b55d239daab8789dd89b863c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5b8bed6464ad6653586e30df046185fd816ad999"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3e20cb072679bdb47747ccc8bee3233a4cf0765a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4e3ace0051e7e504b55d239daab8789dd89b863c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5b8bed6464ad6653586e30df046185fd816ad999"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-05T21:19:51+00:00",
      "cve": "CVE-2021-47191",
      "id": "CVE-2021-47191",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47191.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:40:11Z",
      "cve": "CVE-2021-47191",
      "id": "CVE-2021-47191",
      "initial_release_date": "2024-04-17T02:29:25Z",
      "product_status:known_affected": "453",
      "product_status:known_not_affected": "68",
      "product_status:recommended": "547",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47191",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47191.json",
      "version": "63"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:32:07.284Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/3e20cb072679bdb47747ccc8bee3233a4cf0765a"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/5b8bed6464ad6653586e30df046185fd816ad999"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4e3ace0051e7e504b55d239daab8789dd89b863c"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47191",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-17T18:03:54.717932Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-17T18:03:55.961Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/scsi/scsi_debug.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "3e20cb072679bdb47747ccc8bee3233a4cf0765a",
                  "status": "affected",
                  "version": "c65b1445d153a66ca91b00c1f10187e495c17918",
                  "versionType": "git"
                },
                {
                  "lessThan": "5b8bed6464ad6653586e30df046185fd816ad999",
                  "status": "affected",
                  "version": "c65b1445d153a66ca91b00c1f10187e495c17918",
                  "versionType": "git"
                },
                {
                  "lessThan": "4e3ace0051e7e504b55d239daab8789dd89b863c",
                  "status": "affected",
                  "version": "c65b1445d153a66ca91b00c1f10187e495c17918",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/scsi/scsi_debug.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.18"
                },
                {
                  "lessThan": "2.6.18",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.82",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.16",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.82",
                      "versionStartIncluding": "2.6.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.5",
                      "versionStartIncluding": "2.6.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.16",
                      "versionStartIncluding": "2.6.18",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix out-of-bound read in resp_readcap16()\n\nThe following warning was observed running syzkaller:\n\n[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in;\n[ 3813.830724]    program syz-executor not setting count and/or reply_len properly\n[ 3813.836956] ==================================================================\n[ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0\n[ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549\n[ 3813.846612] Call Trace:\n[ 3813.846995]  dump_stack+0x108/0x15f\n[ 3813.847524]  print_address_description+0xa5/0x372\n[ 3813.848243]  kasan_report.cold+0x236/0x2a8\n[ 3813.849439]  check_memory_region+0x240/0x270\n[ 3813.850094]  memcpy+0x30/0x80\n[ 3813.850553]  sg_copy_buffer+0x157/0x1e0\n[ 3813.853032]  sg_copy_from_buffer+0x13/0x20\n[ 3813.853660]  fill_from_dev_buffer+0x135/0x370\n[ 3813.854329]  resp_readcap16+0x1ac/0x280\n[ 3813.856917]  schedule_resp+0x41f/0x1630\n[ 3813.858203]  scsi_debug_queuecommand+0xb32/0x17e0\n[ 3813.862699]  scsi_dispatch_cmd+0x330/0x950\n[ 3813.863329]  scsi_request_fn+0xd8e/0x1710\n[ 3813.863946]  __blk_run_queue+0x10b/0x230\n[ 3813.864544]  blk_execute_rq_nowait+0x1d8/0x400\n[ 3813.865220]  sg_common_write.isra.0+0xe61/0x2420\n[ 3813.871637]  sg_write+0x6c8/0xef0\n[ 3813.878853]  __vfs_write+0xe4/0x800\n[ 3813.883487]  vfs_write+0x17b/0x530\n[ 3813.884008]  ksys_write+0x103/0x270\n[ 3813.886268]  __x64_sys_write+0x77/0xc0\n[ 3813.886841]  do_syscall_64+0x106/0x360\n[ 3813.887415]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nThis issue can be reproduced with the following syzkaller log:\n\nr0 = openat(0xffffffffffffff9c, \u0026(0x7f0000000040)=\u0027./file0\\x00\u0027, 0x26e1, 0x0)\nr1 = syz_open_procfs(0xffffffffffffffff, \u0026(0x7f0000000000)=\u0027fd/3\\x00\u0027)\nopen_by_handle_at(r1, \u0026(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000)\nr2 = syz_open_dev$sg(\u0026(0x7f0000000000), 0x0, 0x40782)\nwrite$binfmt_aout(r2, \u0026(0x7f0000000340)=ANY=[@ANYBLOB=\"00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d\"], 0x126)\n\nIn resp_readcap16() we get \"int alloc_len\" value -1104926854, and then pass\nthe huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This\nleads to OOB in sg_copy_buffer().\n\nTo solve this issue, define alloc_len as u32."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is reached by issuing a SCSI READ CAPACITY(16) CDB via write/ioctl on /dev/sg (or SG_IO on the scsi_debug block device), which is a local syscall path, not a network-facing protocol handler.\nAC:L - An attacker who can open the scsi_debug sg device can reliably trigger the OOB by setting the allocation length field with the high bit set; no race or other attacker-uncontrolled condition is required.\nPR:L - SERVICE_ACTION_IN_16 (0x9e) is on the unprivileged scsi_cmd_allowed allowlist, so CAP_SYS_RAWIO is not required; access only needs open permission on /dev/sg*, typically via membership in the disk group.\nUI:N - The attacker opens the device and sends the crafted SCSI command themselves; no separate victim action is required.\nS:U - This is a host-kernel memory-safety bug in the scsi_debug simulator with impact confined to the same privilege domain; it does not cross a VM, IOMMU, or other security authority boundary.\nC:H - A signed min_t() miscomparison turns a attacker-controlled allocation length into a huge size_t, causing fill_from_dev_buffer()/sg_copy_from_buffer() to read far past the 32-byte stack array and return that kernel stack memory to userspace via the SCSI data-in buffer.\nI:N - The corruption is a stack out-of-bounds read into the response buffer only; there is no out-of-bounds write or other integrity-modifying primitive.\nA:H - The unbounded stack OOB read can fault into unmapped memory and produce a kernel oops/panic, matching the KASAN-detected crash path in the report."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:46:37.004Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/3e20cb072679bdb47747ccc8bee3233a4cf0765a"
            },
            {
              "url": "https://git.kernel.org/stable/c/5b8bed6464ad6653586e30df046185fd816ad999"
            },
            {
              "url": "https://git.kernel.org/stable/c/4e3ace0051e7e504b55d239daab8789dd89b863c"
            }
          ],
          "title": "scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47191",
        "datePublished": "2024-04-10T18:56:29.455Z",
        "dateReserved": "2024-03-25T09:12:14.113Z",
        "dateUpdated": "2026-08-05T08:46:37.004Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.