CVE-2021-47485 (GCVE-0-2021-47485)
Vulnerability from cvelistv5 – Published: 2024-05-22 08:19 – Updated: 2026-08-05 08:48
VLAI
EPSS
VEX
Title
IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
Overflowing either addrlimit or bytes_togo can allow userspace to trigger
a buffer overflow of kernel memory. Check for overflows in all the places
doing math on user controlled buffers.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-22 18:45 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
f931551bafe1f10ded7f5282e2aa162c267a2e5d , < bda41654b6e0c125a624ca35d6d20beb8015b5d0
(git)
Affected: f931551bafe1f10ded7f5282e2aa162c267a2e5d , < 3f57c3f67fd93b4da86aeffea1ca32c484d054ad (git) Affected: f931551bafe1f10ded7f5282e2aa162c267a2e5d , < 60833707b968d5ae02a75edb7886dcd4a957cf0d (git) Affected: f931551bafe1f10ded7f5282e2aa162c267a2e5d , < 73d2892148aa4397a885b4f4afcfc5b27a325c42 (git) Affected: f931551bafe1f10ded7f5282e2aa162c267a2e5d , < 0f8cdfff06829a0b0348b6debc29ff6a61967724 (git) Affected: f931551bafe1f10ded7f5282e2aa162c267a2e5d , < c3e17e58f571f34c51aeb17274ed02c2ed5cf780 (git) Affected: f931551bafe1f10ded7f5282e2aa162c267a2e5d , < 0d4395477741608d123dad51def9fe50b7ebe952 (git) Affected: f931551bafe1f10ded7f5282e2aa162c267a2e5d , < d39bf40e55e666b5905fdbd46a0dced030ce87be (git) |
guessed | |
| Linux | Linux |
Affected:
2.6.35
Unaffected: 0 , < 2.6.35 (semver) Unaffected: 4.4.292 , ≤ 4.4.* (semver) Unaffected: 4.9.290 , ≤ 4.9.* (semver) Unaffected: 4.14.255 , ≤ 4.14.* (semver) Unaffected: 4.19.216 , ≤ 4.19.* (semver) Unaffected: 5.4.157 , ≤ 5.4.* (semver) Unaffected: 5.10.77 , ≤ 5.10.* (semver) Unaffected: 5.14.16 , ≤ 5.14.* (semver) Unaffected: 5.15 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47485",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-22T18:45:08.968768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:14:26.389Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:39:59.745Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/qib/qib_user_sdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bda41654b6e0c125a624ca35d6d20beb8015b5d0",
"status": "affected",
"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d",
"versionType": "git"
},
{
"lessThan": "3f57c3f67fd93b4da86aeffea1ca32c484d054ad",
"status": "affected",
"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d",
"versionType": "git"
},
{
"lessThan": "60833707b968d5ae02a75edb7886dcd4a957cf0d",
"status": "affected",
"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d",
"versionType": "git"
},
{
"lessThan": "73d2892148aa4397a885b4f4afcfc5b27a325c42",
"status": "affected",
"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d",
"versionType": "git"
},
{
"lessThan": "0f8cdfff06829a0b0348b6debc29ff6a61967724",
"status": "affected",
"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d",
"versionType": "git"
},
{
"lessThan": "c3e17e58f571f34c51aeb17274ed02c2ed5cf780",
"status": "affected",
"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d",
"versionType": "git"
},
{
"lessThan": "0d4395477741608d123dad51def9fe50b7ebe952",
"status": "affected",
"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d",
"versionType": "git"
},
{
"lessThan": "d39bf40e55e666b5905fdbd46a0dced030ce87be",
"status": "affected",
"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/qib/qib_user_sdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.*",
"status": "unaffected",
"version": "4.4.292",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.290",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.255",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.14.*",
"status": "unaffected",
"version": "5.14.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.292",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.290",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.255",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.216",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.157",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.77",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.16",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\n\nOverflowing either addrlimit or bytes_togo can allow userspace to trigger\na buffer overflow of kernel memory. Check for overflows in all the places\ndoing math on user controlled buffers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local writev/write_iter on the qib char device (/dev/ipath) after context assignment; it is not triggered by remote InfiniBand packet processing.\nAC:L - The attacker fully controls iovec lengths and PBC/header fields that drive the overflowing arithmetic, so the heap overflow can be triggered reliably once the QIB device is present and SDMA is running.\nPR:L - No capabilities are checked on the open/assign/writev path; access is only gated by /dev/ipath permissions, and this userspace SDMA interface is intended for unprivileged PSM/MPI processes on systems with the HCA.\nUI:N - The attacker opens the device and issues crafted write/writev calls themselves; no separate victim action is required.\nS:U - Impact is kernel memory corruption and privilege escalation on the same host authority, not a cross-boundary escape (VM/IOMMU/sandbox).\nC:H - A controllable kernel heap buffer overflow can be leveraged for arbitrary kernel memory disclosure.\nI:H - Kernel heap overflow of qib_user_sdma_pkt addr[]/adjacent memory enables arbitrary write and control-flow hijacking for full integrity compromise.\nA:H - The same heap corruption can cause kernel oops/panic or hang, fully impacting availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:48:01.651Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0"
},
{
"url": "https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad"
},
{
"url": "https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d"
},
{
"url": "https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42"
},
{
"url": "https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724"
},
{
"url": "https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780"
},
{
"url": "https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952"
},
{
"url": "https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be"
}
],
"title": "IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47485",
"datePublished": "2024-05-22T08:19:36.158Z",
"dateReserved": "2024-05-22T06:20:56.201Z",
"dateUpdated": "2026-08-05T08:48:01.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-47485",
"date": "2026-09-15",
"epss": "0.00237",
"percentile": "0.14806"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.6.35\", \"versionEndExcluding\": \"4.4.292\", \"matchCriteriaId\": \"A3AEC86A-6474-4042-91D8-DD381C1F06DF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.5\", \"versionEndExcluding\": \"4.9.290\", \"matchCriteriaId\": \"85D8337A-4EA1-4787-85EA-4BF4328A9436\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.10\", \"versionEndExcluding\": \"4.14.255\", \"matchCriteriaId\": \"436BD498-0DB1-4290-9A36-A52CB11B3AC3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.15\", \"versionEndExcluding\": \"4.19.216\", \"matchCriteriaId\": \"0F384B60-1DBA-4E2B-9110-0087D95F30DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.157\", \"matchCriteriaId\": \"8FBCA21B-424F-4B7F-A9A8-FDD64FE6BD3B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.77\", \"matchCriteriaId\": \"26EB7ED9-AEA3-4829-8B5E-08571262F72A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.14.16\", \"matchCriteriaId\": \"2681B950-4548-4649-A9E1-4124B59FC09C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"E46C74C6-B76B-4C94-A6A4-FD2FFF62D644\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"60134C3A-06E4-48C1-B04F-2903732A4E56\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"0460DA88-8FE1-46A2-9DDA-1F1ABA552E71\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF55383D-4DF2-45DC-93F7-571F4F978EAB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"EBD45831-4B79-42BC-ABC0-86870F0DEA89\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"948A6B8D-1B72-4945-8680-354E53BE1C80\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nIB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\\n\\nOverflowing either addrlimit or bytes_togo can allow userspace to trigger\\na buffer overflow of kernel memory. Check for overflows in all the places\\ndoing math on user controlled buffers.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: IB/qib: Protege contra el desbordamiento del b\\u00fafer en los campos de struct qib_user_sdma_pkt. El desbordamiento de addrlimit o bytes_togo puede permitir que el espacio de usuario desencadene un desbordamiento del b\\u00fafer de la memoria del kernel. Compruebe si hay desbordamientos en todos los lugares que realizan c\\u00e1lculos en b\\u00faferes controlados por el usuario.\"}]",
"id": "CVE-2021-47485",
"lastModified": "2025-01-06T19:53:06.807",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
"published": "2024-05-22T09:15:10.503",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-120\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-47485\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-22T09:15:10.503\",\"lastModified\":\"2026-08-04T10:17:05.277\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nIB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\\n\\nOverflowing either addrlimit or bytes_togo can allow userspace to trigger\\na buffer overflow of kernel memory. Check for overflows in all the places\\ndoing math on user controlled buffers.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: IB/qib: Protege contra el desbordamiento del b\u00fafer en los campos de struct qib_user_sdma_pkt. El desbordamiento de addrlimit o bytes_togo puede permitir que el espacio de usuario desencadene un desbordamiento del b\u00fafer de la memoria del kernel. Compruebe si hay desbordamientos en todos los lugares que realizan c\u00e1lculos en b\u00faferes controlados por el usuario.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/qib/qib_user_sdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f931551bafe1f10ded7f5282e2aa162c267a2e5d\",\"lessThan\":\"bda41654b6e0c125a624ca35d6d20beb8015b5d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f931551bafe1f10ded7f5282e2aa162c267a2e5d\",\"lessThan\":\"3f57c3f67fd93b4da86aeffea1ca32c484d054ad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f931551bafe1f10ded7f5282e2aa162c267a2e5d\",\"lessThan\":\"60833707b968d5ae02a75edb7886dcd4a957cf0d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f931551bafe1f10ded7f5282e2aa162c267a2e5d\",\"lessThan\":\"73d2892148aa4397a885b4f4afcfc5b27a325c42\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f931551bafe1f10ded7f5282e2aa162c267a2e5d\",\"lessThan\":\"0f8cdfff06829a0b0348b6debc29ff6a61967724\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f931551bafe1f10ded7f5282e2aa162c267a2e5d\",\"lessThan\":\"c3e17e58f571f34c51aeb17274ed02c2ed5cf780\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f931551bafe1f10ded7f5282e2aa162c267a2e5d\",\"lessThan\":\"0d4395477741608d123dad51def9fe50b7ebe952\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f931551bafe1f10ded7f5282e2aa162c267a2e5d\",\"lessThan\":\"d39bf40e55e666b5905fdbd46a0dced030ce87be\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/qib/qib_user_sdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.35\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.35\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.4.292\",\"lessThanOrEqual\":\"4.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.290\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.255\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.216\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.157\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.77\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14.16\",\"lessThanOrEqual\":\"5.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-22T18:45:08.968768Z\",\"id\":\"CVE-2021-47485\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.35\",\"versionEndExcluding\":\"4.4.292\",\"matchCriteriaId\":\"A3AEC86A-6474-4042-91D8-DD381C1F06DF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5\",\"versionEndExcluding\":\"4.9.290\",\"matchCriteriaId\":\"85D8337A-4EA1-4787-85EA-4BF4328A9436\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.255\",\"matchCriteriaId\":\"436BD498-0DB1-4290-9A36-A52CB11B3AC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.216\",\"matchCriteriaId\":\"0F384B60-1DBA-4E2B-9110-0087D95F30DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.157\",\"matchCriteriaId\":\"8FBCA21B-424F-4B7F-A9A8-FDD64FE6BD3B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.77\",\"matchCriteriaId\":\"26EB7ED9-AEA3-4829-8B5E-08571262F72A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.14.16\",\"matchCriteriaId\":\"2681B950-4548-4649-A9E1-4124B59FC09C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E46C74C6-B76B-4C94-A6A4-FD2FFF62D644\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"60134C3A-06E4-48C1-B04F-2903732A4E56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0460DA88-8FE1-46A2-9DDA-1F1ABA552E71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF55383D-4DF2-45DC-93F7-571F4F978EAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"EBD45831-4B79-42BC-ABC0-86870F0DEA89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"948A6B8D-1B72-4945-8680-354E53BE1C80\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-08-04T23:02:23+00:00",
"cve": "CVE-2021-47485",
"id": "CVE-2021-47485",
"initial_release_date": "2021-01-01T00:00:00+00:00",
"product_status:known_affected": "42",
"product_status:known_not_affected": "156",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47485.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-15T02:30:59Z",
"cve": "CVE-2021-47485",
"id": "CVE-2021-47485",
"initial_release_date": "2024-05-23T03:04:28Z",
"product_status:known_affected": "376",
"product_status:known_not_affected": "55",
"product_status:recommended": "699",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2021-47485",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47485.json",
"version": "64"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.745Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47485\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-22T18:45:08.968768Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-22T18:45:18.857Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only via local writev/write_iter on the qib char device (/dev/ipath) after context assignment; it is not triggered by remote InfiniBand packet processing.\\nAC:L - The attacker fully controls iovec lengths and PBC/header fields that drive the overflowing arithmetic, so the heap overflow can be triggered reliably once the QIB device is present and SDMA is running.\\nPR:L - No capabilities are checked on the open/assign/writev path; access is only gated by /dev/ipath permissions, and this userspace SDMA interface is intended for unprivileged PSM/MPI processes on systems with the HCA.\\nUI:N - The attacker opens the device and issues crafted write/writev calls themselves; no separate victim action is required.\\nS:U - Impact is kernel memory corruption and privilege escalation on the same host authority, not a cross-boundary escape (VM/IOMMU/sandbox).\\nC:H - A controllable kernel heap buffer overflow can be leveraged for arbitrary kernel memory disclosure.\\nI:H - Kernel heap overflow of qib_user_sdma_pkt addr[]/adjacent memory enables arbitrary write and control-flow hijacking for full integrity compromise.\\nA:H - The same heap corruption can cause kernel oops/panic or hang, fully impacting availability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f931551bafe1f10ded7f5282e2aa162c267a2e5d\", \"lessThan\": \"bda41654b6e0c125a624ca35d6d20beb8015b5d0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f931551bafe1f10ded7f5282e2aa162c267a2e5d\", \"lessThan\": \"3f57c3f67fd93b4da86aeffea1ca32c484d054ad\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f931551bafe1f10ded7f5282e2aa162c267a2e5d\", \"lessThan\": \"60833707b968d5ae02a75edb7886dcd4a957cf0d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f931551bafe1f10ded7f5282e2aa162c267a2e5d\", \"lessThan\": \"73d2892148aa4397a885b4f4afcfc5b27a325c42\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f931551bafe1f10ded7f5282e2aa162c267a2e5d\", \"lessThan\": \"0f8cdfff06829a0b0348b6debc29ff6a61967724\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f931551bafe1f10ded7f5282e2aa162c267a2e5d\", \"lessThan\": \"c3e17e58f571f34c51aeb17274ed02c2ed5cf780\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f931551bafe1f10ded7f5282e2aa162c267a2e5d\", \"lessThan\": \"0d4395477741608d123dad51def9fe50b7ebe952\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f931551bafe1f10ded7f5282e2aa162c267a2e5d\", \"lessThan\": \"d39bf40e55e666b5905fdbd46a0dced030ce87be\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/hw/qib/qib_user_sdma.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.35\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.35\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.4.292\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.4.*\"}, {\"status\": \"unaffected\", \"version\": \"4.9.290\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.255\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.216\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.157\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.77\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/hw/qib/qib_user_sdma.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0\"}, {\"url\": \"https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad\"}, {\"url\": \"https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d\"}, {\"url\": \"https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42\"}, {\"url\": \"https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724\"}, {\"url\": \"https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780\"}, {\"url\": \"https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952\"}, {\"url\": \"https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nIB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\\n\\nOverflowing either addrlimit or bytes_togo can allow userspace to trigger\\na buffer overflow of kernel memory. Check for overflows in all the places\\ndoing math on user controlled buffers.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.4.292\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.290\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.255\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.216\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.157\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.77\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.16\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"2.6.35\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:01.651Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-47485\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:01.651Z\", \"dateReserved\": \"2024-05-22T06:20:56.201Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-22T08:19:36.158Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…