Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47580— scsi: scsi_debug: Fix type in min_t to avoid stack OOB

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于允许堆栈越界。

CVSS 7.1 · High EPSS 0.24% · P15

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 87c715dcde633f4cc4690a24a240e838181e6a9d< bdb854f134b964528fa543e0351022eb45bd7346 affected
87c715dcde633f4cc4690a24a240e838181e6a9d< 3085147645938eb41f0bc0e25ef9791e71f5ee4b affected
87c715dcde633f4cc4690a24a240e838181e6a9d< 36e07d7ede88a1f1ef8f0f209af5b7612324ac2c affected
5.8 affected
< 5.8 unaffected
5.10.88≤ 5.10.* unaffected
5.15.11≤ 5.15.* unaffected
5.16≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47580

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
scsi: scsi_debug: Fix type in min_t to avoid stack OOB
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix type in min_t to avoid stack OOB Change min_t() to use type "u32" instead of type "int" to avoid stack out of bounds. With min_t() type "int" the values get sign extended and the larger value gets used causing stack out of bounds. BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:191 [inline] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976 Read of size 127 at addr ffff888072607128 by task syz-executor.7/18707 CPU: 1 PID: 18707 Comm: syz-executor.7 Not tainted 5.15.0-syzk #1 Hardware name: Red Hat KVM, BIOS 1.13.0-2 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:256 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189 memcpy+0x23/0x60 mm/kasan/shadow.c:65 memcpy include/linux/fortify-string.h:191 [inline] sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976 sg_copy_from_buffer+0x33/0x40 lib/scatterlist.c:1000 fill_from_dev_buffer.part.34+0x82/0x130 drivers/scsi/scsi_debug.c:1162 fill_from_dev_buffer drivers/scsi/scsi_debug.c:1888 [inline] resp_readcap16+0x365/0x3b0 drivers/scsi/scsi_debug.c:1887 schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478 scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533 scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline] scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358 __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62 sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:836 sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:774 sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:939 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于允许堆栈越界。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 87c715dcde633f4cc4690a24a240e838181e6a9d ~ bdb854f134b964528fa543e0351022eb45bd7346 -
Linux Linux 5.8 -

II. Public POCs for CVE-2021-47580

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47580

请登录查看更多情报信息。

Other References for CVE-2021-47580 (3)

Same Patch Batch · Linux · 2024-06-19 · 122 CVEs total

CVE-2024-38558 10.0 CRITICAL net: openvswitch: fix overwriting ct original tuple for ICMPv6
CVE-2024-38570 9.8 CRITICAL gfs2: Fix potential glock use-after-free on unmount
CVE-2021-47587 9.8 CRITICAL net: systemport: Add global locking for descriptor lifecycle
CVE-2024-38544 9.8 CRITICAL RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
CVE-2021-47611 8.1 HIGH mac80211: validate extended element ID is present
CVE-2024-38587 7.8 HIGH speakup: Fix sizeof() vs ARRAY_SIZE() bug
CVE-2024-38556 7.8 HIGH net/mlx5: Add a timeout to acquire the command queue semaphore
CVE-2024-38610 7.8 HIGH drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
CVE-2024-38605 7.8 HIGH ALSA: core: Fix NULL module pointer assignment at card init
CVE-2024-38599 7.8 HIGH jffs2: prevent xattr node from overflowing the eraseblock
CVE-2024-38592 7.8 HIGH drm/mediatek: Init `ddp_comp` with devm_kcalloc()
CVE-2024-38564 7.8 HIGH bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
CVE-2024-38568 7.8 HIGH drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
CVE-2024-38572 7.8 HIGH wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
CVE-2024-38578 7.8 HIGH ecryptfs: Fix buffer size for tag 66 packet
CVE-2024-38580 7.8 HIGH epoll: be better about file lifetimes
CVE-2024-38569 7.8 HIGH drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
CVE-2024-38583 7.8 HIGH nilfs2: fix use-after-free of timer for log writer thread
CVE-2024-38614 7.8 HIGH openrisc: traps: Don't send signals to kernel mode threads
CVE-2024-38588 7.8 HIGH ftrace: Fix possible use-after-free issue in ftrace_location()

Showing top 20 of 122 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47580

No comments yet

Leave a comment