GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47240 (GCVE-0-2021-47240)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:19 – Updated: 2026-08-05 08:46
VLAI
Title
net: qrtr: fix OOB Read in qrtr_endpoint_post
Summary
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB Read in qrtr_endpoint_post Syzbot reported slab-out-of-bounds Read in qrtr_endpoint_post. The problem was in wrong _size_ type: if (len != ALIGN(size, 4) + hdrlen) goto err; If size from qrtr_hdr is 4294967293 (0xfffffffd), the result of ALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293 in header this check won't fail and skb_put_data(skb, data + hdrlen, size); will read out of bound from data, which is hdrlen allocated block.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-23 21:23 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 194ccc88297ae78d0803adad83c6dcc369787c9e , < f8111c0d7ed42ede41a3d0d393b104de0730a8a6 (git)
Affected: 194ccc88297ae78d0803adad83c6dcc369787c9e , < 26b8d10703a9be45d6097946b2b4011f7dd2c56f (git)
Affected: 194ccc88297ae78d0803adad83c6dcc369787c9e , < 960b08dd36de1e341e3eb43d1c547513e338f4f8 (git)
Affected: 194ccc88297ae78d0803adad83c6dcc369787c9e , < 19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe (git)
Affected: 194ccc88297ae78d0803adad83c6dcc369787c9e , < ad9d24c9429e2159d1e279dc3a83191ccb4daf1d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 4.19.196 , ≤ 4.19.* (semver)
Unaffected: 5.4.128 , ≤ 5.4.* (semver)
Unaffected: 5.10.46 , ≤ 5.10.* (semver)
Unaffected: 5.12.13 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47240",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T21:23:18.343399Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:27.293Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.052Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/qrtr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f8111c0d7ed42ede41a3d0d393b104de0730a8a6",
              "status": "affected",
              "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
              "versionType": "git"
            },
            {
              "lessThan": "26b8d10703a9be45d6097946b2b4011f7dd2c56f",
              "status": "affected",
              "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
              "versionType": "git"
            },
            {
              "lessThan": "960b08dd36de1e341e3eb43d1c547513e338f4f8",
              "status": "affected",
              "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
              "versionType": "git"
            },
            {
              "lessThan": "19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe",
              "status": "affected",
              "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
              "versionType": "git"
            },
            {
              "lessThan": "ad9d24c9429e2159d1e279dc3a83191ccb4daf1d",
              "status": "affected",
              "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/qrtr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.196",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.128",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.46",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix OOB Read in qrtr_endpoint_post\n\nSyzbot reported slab-out-of-bounds Read in\nqrtr_endpoint_post. The problem was in wrong\n_size_ type:\n\n\tif (len != ALIGN(size, 4) + hdrlen)\n\t\tgoto err;\n\nIf size from qrtr_hdr is 4294967293 (0xfffffffd), the result of\nALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293\nin header this check won\u0027t fail and\n\n\tskb_put_data(skb, data + hdrlen, size);\n\nwill read out of bound from data, which is hdrlen allocated block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - qrtr_endpoint_post is reached from local endpoint drivers (MHI/SMD to an on-board modem or WiFi peer over PCIe, or a write to /dev/qrtr-tun); mainline QRTR has no IP transport, so a remote network packet cannot hit this path.\nAC:L - A crafted QRTR header with size near UINT_MAX (e.g. 0xfffffffd) deterministically makes ALIGN(size,4) wrap to 0 so the length check passes; the attacker fully controls the packet bytes and needs no race or unpredictable layout.\nPR:N - On the MHI/SMD path the vulnerable parser runs on unauthenticated device-to-host IPCR completions with no host capability or credential check, so a compromised or malicious peripheral peer triggers it without any local account (worst case over the also-reachable PR:L qrtr-tun path).\nUI:N - The attacker (or malicious MHI peer) delivers the malformed packet itself; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The resulting kernel heap read/write and oops stay inside the host kernel\u0027s QRTR authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - skb_put_data memcpy performs a multi-gigabyte out-of-bounds read from the hdrlen-sized source buffer into/past the skb (KASAN: Read of size ~4294967294), which per guidance is an unbounded OOB read treated as High confidentiality impact.\nI:H - The same memcpy writes past the hdrlen-sized skb into adjacent kernel memory because sk_buff_data_t wrap bypasses skb_put\u0027s overflow check (confirmed by the later 32-bit follow-up describing a write past the skb), yielding a heap overflow write primitive.\nA:H - The huge OOB access faults/oopses the kernel (and is a hard KASAN failure), producing full availability loss on affected systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:52.072Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f"
        },
        {
          "url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d"
        }
      ],
      "title": "net: qrtr: fix OOB Read in qrtr_endpoint_post",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47240",
    "datePublished": "2024-05-21T14:19:40.363Z",
    "dateReserved": "2024-04-10T18:59:19.532Z",
    "dateUpdated": "2026-08-05T08:46:52.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47240",
      "date": "2026-09-19",
      "epss": "0.00239",
      "percentile": "0.15294"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F3CAB837-7D38-4934-AD4F-195CEFD754E6",
                  "versionEndExcluding": "4.19.196",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6267BD4E-BE25-48B5-B850-4B493440DAFA",
                  "versionEndExcluding": "5.4.128",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "59455D13-A902-42E1-97F7-5ED579777193",
                  "versionEndExcluding": "5.10.46",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7806E7E5-6D4F-4E18-81C1-79B3C60EE855",
                  "versionEndExcluding": "5.12.13",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "1ECD33F5-85BE-430B-8F86-8D7BD560311D",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*",
                  "matchCriteriaId": "CF351855-2437-4CF5-AD7C-BDFA51F27683",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*",
                  "matchCriteriaId": "25A855BA-2118-44F2-90EF-EBBB12AF51EF",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix OOB Read in qrtr_endpoint_post\n\nSyzbot reported slab-out-of-bounds Read in\nqrtr_endpoint_post. The problem was in wrong\n_size_ type:\n\n\tif (len != ALIGN(size, 4) + hdrlen)\n\t\tgoto err;\n\nIf size from qrtr_hdr is 4294967293 (0xfffffffd), the result of\nALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293\nin header this check won\u0027t fail and\n\n\tskb_put_data(skb, data + hdrlen, size);\n\nwill read out of bound from data, which is hdrlen allocated block."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: qrtr: arreglar OOB Lectura en qrtr_endpoint_post. Syzbot report\u00f3 slab-out-of-bounds Lectura en qrtr_endpoint_post. El problema estaba en el tipo de _tama\u00f1o_ incorrecto: if (len != ALIGN(size, 4) + hdrlen) goto err; Si el tama\u00f1o de qrtr_hdr es 4294967293 (0xfffffffd), el resultado de ALIGN(size, 4) ser\u00e1 0. En caso de len == hdrlen y size == 4294967293 en el encabezado, esta verificaci\u00f3n no fallar\u00e1 y skb_put_data(skb, data + hdrlen, tama\u00f1o); leer\u00e1 fuera de los l\u00edmites de los datos, que son bloques asignados hdrlen."
        }
      ],
      "id": "CVE-2021-47240",
      "lastModified": "2024-12-30T19:04:58.760",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.2,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-05-21T15:15:13.177",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-125"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/qrtr/qrtr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f8111c0d7ed42ede41a3d0d393b104de0730a8a6",
                    "status": "affected",
                    "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "26b8d10703a9be45d6097946b2b4011f7dd2c56f",
                    "status": "affected",
                    "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "960b08dd36de1e341e3eb43d1c547513e338f4f8",
                    "status": "affected",
                    "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe",
                    "status": "affected",
                    "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ad9d24c9429e2159d1e279dc3a83191ccb4daf1d",
                    "status": "affected",
                    "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/qrtr/qrtr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.15"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.196",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.128",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.12.*",
                    "status": "unaffected",
                    "version": "5.12.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F3CAB837-7D38-4934-AD4F-195CEFD754E6",
                    "versionEndExcluding": "4.19.196",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6267BD4E-BE25-48B5-B850-4B493440DAFA",
                    "versionEndExcluding": "5.4.128",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "59455D13-A902-42E1-97F7-5ED579777193",
                    "versionEndExcluding": "5.10.46",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7806E7E5-6D4F-4E18-81C1-79B3C60EE855",
                    "versionEndExcluding": "5.12.13",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1ECD33F5-85BE-430B-8F86-8D7BD560311D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "CF351855-2437-4CF5-AD7C-BDFA51F27683",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "25A855BA-2118-44F2-90EF-EBBB12AF51EF",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix OOB Read in qrtr_endpoint_post\n\nSyzbot reported slab-out-of-bounds Read in\nqrtr_endpoint_post. The problem was in wrong\n_size_ type:\n\n\tif (len != ALIGN(size, 4) + hdrlen)\n\t\tgoto err;\n\nIf size from qrtr_hdr is 4294967293 (0xfffffffd), the result of\nALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293\nin header this check won\u0027t fail and\n\n\tskb_put_data(skb, data + hdrlen, size);\n\nwill read out of bound from data, which is hdrlen allocated block."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: qrtr: arreglar OOB Lectura en qrtr_endpoint_post. Syzbot report\u00f3 slab-out-of-bounds Lectura en qrtr_endpoint_post. El problema estaba en el tipo de _tama\u00f1o_ incorrecto: if (len != ALIGN(size, 4) + hdrlen) goto err; Si el tama\u00f1o de qrtr_hdr es 4294967293 (0xfffffffd), el resultado de ALIGN(size, 4) ser\u00e1 0. En caso de len == hdrlen y size == 4294967293 en el encabezado, esta verificaci\u00f3n no fallar\u00e1 y skb_put_data(skb, data + hdrlen, tama\u00f1o); leer\u00e1 fuera de los l\u00edmites de los datos, que son bloques asignados hdrlen."
          }
        ],
        "id": "CVE-2021-47240",
        "lastModified": "2026-08-04T10:16:54.013",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47240",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T21:23:18.343399Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-21T15:15:13.177",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:03:27+00:00",
      "cve": "CVE-2021-47240",
      "id": "CVE-2021-47240",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: qrtr: fix OOB Read in qrtr_endpoint_post",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47240.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:36:49Z",
      "cve": "CVE-2021-47240",
      "id": "CVE-2021-47240",
      "initial_release_date": "2024-05-23T03:05:30Z",
      "product_status:known_not_affected": "314",
      "product_status:recommended": "129",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47240",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47240.json",
      "version": "33"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:32:08.052Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47240",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-23T21:23:18.343399Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T21:23:53.144Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/qrtr/qrtr.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "f8111c0d7ed42ede41a3d0d393b104de0730a8a6",
                  "status": "affected",
                  "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
                  "versionType": "git"
                },
                {
                  "lessThan": "26b8d10703a9be45d6097946b2b4011f7dd2c56f",
                  "status": "affected",
                  "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
                  "versionType": "git"
                },
                {
                  "lessThan": "960b08dd36de1e341e3eb43d1c547513e338f4f8",
                  "status": "affected",
                  "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
                  "versionType": "git"
                },
                {
                  "lessThan": "19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe",
                  "status": "affected",
                  "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
                  "versionType": "git"
                },
                {
                  "lessThan": "ad9d24c9429e2159d1e279dc3a83191ccb4daf1d",
                  "status": "affected",
                  "version": "194ccc88297ae78d0803adad83c6dcc369787c9e",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/qrtr/qrtr.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.15"
                },
                {
                  "lessThan": "4.15",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.196",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.128",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.46",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.12.*",
                  "status": "unaffected",
                  "version": "5.12.13",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.196",
                      "versionStartIncluding": "4.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.128",
                      "versionStartIncluding": "4.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.46",
                      "versionStartIncluding": "4.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.13",
                      "versionStartIncluding": "4.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13",
                      "versionStartIncluding": "4.15",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix OOB Read in qrtr_endpoint_post\n\nSyzbot reported slab-out-of-bounds Read in\nqrtr_endpoint_post. The problem was in wrong\n_size_ type:\n\n\tif (len != ALIGN(size, 4) + hdrlen)\n\t\tgoto err;\n\nIf size from qrtr_hdr is 4294967293 (0xfffffffd), the result of\nALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293\nin header this check won\u0027t fail and\n\n\tskb_put_data(skb, data + hdrlen, size);\n\nwill read out of bound from data, which is hdrlen allocated block."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - qrtr_endpoint_post is reached from local endpoint drivers (MHI/SMD to an on-board modem or WiFi peer over PCIe, or a write to /dev/qrtr-tun); mainline QRTR has no IP transport, so a remote network packet cannot hit this path.\nAC:L - A crafted QRTR header with size near UINT_MAX (e.g. 0xfffffffd) deterministically makes ALIGN(size,4) wrap to 0 so the length check passes; the attacker fully controls the packet bytes and needs no race or unpredictable layout.\nPR:N - On the MHI/SMD path the vulnerable parser runs on unauthenticated device-to-host IPCR completions with no host capability or credential check, so a compromised or malicious peripheral peer triggers it without any local account (worst case over the also-reachable PR:L qrtr-tun path).\nUI:N - The attacker (or malicious MHI peer) delivers the malformed packet itself; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The resulting kernel heap read/write and oops stay inside the host kernel\u0027s QRTR authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - skb_put_data memcpy performs a multi-gigabyte out-of-bounds read from the hdrlen-sized source buffer into/past the skb (KASAN: Read of size ~4294967294), which per guidance is an unbounded OOB read treated as High confidentiality impact.\nI:H - The same memcpy writes past the hdrlen-sized skb into adjacent kernel memory because sk_buff_data_t wrap bypasses skb_put\u0027s overflow check (confirmed by the later 32-bit follow-up describing a write past the skb), yielding a heap overflow write primitive.\nA:H - The huge OOB access faults/oopses the kernel (and is a hard KASAN failure), producing full availability loss on affected systems."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:46:52.072Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6"
            },
            {
              "url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f"
            },
            {
              "url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8"
            },
            {
              "url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe"
            },
            {
              "url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d"
            }
          ],
          "title": "net: qrtr: fix OOB Read in qrtr_endpoint_post",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47240",
        "datePublished": "2024-05-21T14:19:40.363Z",
        "dateReserved": "2024-04-10T18:59:19.532Z",
        "dateUpdated": "2026-08-05T08:46:52.072Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.