Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47219— scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于resp_report_tgtpgs()允许越界读取。

CVSS 7.1 · High EPSS 0.25% · P15

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 5a09e39810ae0465016c380962e12dd115779b87< 8440377e1a5644779b4c8d013aa2a917f5fc83c3 affected
5a09e39810ae0465016c380962e12dd115779b87< 66523553fa62c7878fc5441dc4e82be71934eb77 affected
5a09e39810ae0465016c380962e12dd115779b87< f347c26836c270199de1599c3cd466bb7747caa9 affected
2.6.19 affected
< 2.6.19 unaffected
5.10.82≤ 5.10.* unaffected
5.15.5≤ 5.15.* unaffected
5.16≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47219

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() The following issue was observed running syzkaller: BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Read of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815 CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe4/0x14a lib/dump_stack.c:118 print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352 [inline] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:377 [inline] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429 scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034 __blk_run_queue_uncond block/blk-core.c:464 [inline] __blk_run_queue+0x1a4/0x380 block/blk-core.c:484 blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0 drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599 do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe We get 'alen' from command its type is int. If userspace passes a large length we will get a negative 'alen'. Switch n, alen, and rlen to u32.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于resp_report_tgtpgs()允许越界读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5a09e39810ae0465016c380962e12dd115779b87 ~ 8440377e1a5644779b4c8d013aa2a917f5fc83c3 -
Linux Linux 2.6.19 -

II. Public POCs for CVE-2021-47219

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47219

请登录查看更多情报信息。

Other References for CVE-2021-47219 (3)

Same Patch Batch · Linux · 2024-04-10 · 39 CVEs total

CVE-2021-47215 9.8 CRITICAL net/mlx5e: kTLS, Fix crash in RX resync flow
CVE-2021-47203 8.8 HIGH scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
CVE-2021-47183 8.8 HIGH scsi: lpfc: Fix link down processing to address NULL pointer dereference
CVE-2021-47184 8.8 HIGH i40e: Fix NULL ptr dereference on VSI filter sync
CVE-2021-47201 7.8 HIGH iavf: free q_vectors before queues in iavf_disable_vf
CVE-2021-47200 7.8 HIGH drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
CVE-2024-26815 7.8 HIGH net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
CVE-2021-47197 7.8 HIGH net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
CVE-2021-47188 7.8 HIGH scsi: ufs: core: Improve SCSI abort handling
CVE-2021-47189 7.8 HIGH btrfs: fix memory ordering between normal and ordered work functions
CVE-2021-47196 7.8 HIGH RDMA/core: Set send and receive CQ before forwarding to the driver
CVE-2021-47194 7.8 HIGH cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
CVE-2021-47209 7.8 HIGH sched/fair: Prevent dead task groups from regaining cfs_rq's
CVE-2021-47191 7.1 HIGH scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
CVE-2021-47210 usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
CVE-2021-47198 scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
CVE-2021-47207 ALSA: gus: fix null pointer dereference on pointer block
CVE-2021-47211 ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
CVE-2021-47212 net/mlx5: Update error handler for UCTX and UMEM
CVE-2021-47214 hugetlb, userfaultfd: fix reservation restore on userfaultfd error

Showing top 20 of 39 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47219

No comments yet

Leave a comment