CVE-2021-47478

isofs: Fix out of bound access for corrupted isofs image

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

isofs: Fix out of bound access for corrupted isofs image

When isofs image is suitably corrupted isofs_read_inode() can read data
beyond the end of buffer. Sanity-check the directory entry length before
using it.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: isofs: corrige el acceso fuera de los límites para una imagen isofs corrupta. Cuando la imagen isofs está adecuadamente dañada, isofs_read_inode() puede leer datos más allá del final del búfer. Cordura: verifique la longitud de la entrada del directorio antes de usarla.

*Credits: N/A

CVSS Scores

CISAv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-22 CVE Reserved
2024-05-22 CVE Published
2024-05-23 EPSS Updated
2024-11-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-125: Out-of-bounds Read

CAPEC

References (9)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/156ce5bb6cc43a80a743810199defb1dc3f55b7f	2021-11-12
https://git.kernel.org/stable/c/9ec33a9b8790c212cc926a88c5e2105f97f3f57e	2021-11-12
https://git.kernel.org/stable/c/afbd40f425227e661d991757e11cc4db024e761f	2021-11-12
https://git.kernel.org/stable/c/b0ddff8d68f2e43857a84dce54c3deab181c8ae1	2021-11-12
https://git.kernel.org/stable/c/6e80e9314f8bb52d9eabe1907698718ff01120f5	2021-11-12
https://git.kernel.org/stable/c/86d4aedcbc69c0f84551fb70f953c24e396de2d7	2021-11-12
https://git.kernel.org/stable/c/b2fa1f52d22c5455217b294629346ad23a744945	2021-11-12
https://git.kernel.org/stable/c/e7fb722586a2936b37bdff096c095c30ca06404d	2021-11-12
https://git.kernel.org/stable/c/e96a1866b40570b5950cda8602c2819189c62a48	2021-10-19

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 4.4.292 Search vendor "Linux" for product "Linux Kernel" and version " < 4.4.292"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 4.9.290 Search vendor "Linux" for product "Linux Kernel" and version " < 4.9.290"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 4.14.255 Search vendor "Linux" for product "Linux Kernel" and version " < 4.14.255"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 4.19.217 Search vendor "Linux" for product "Linux Kernel" and version " < 4.19.217"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.4.159 Search vendor "Linux" for product "Linux Kernel" and version " < 5.4.159"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.10.79 Search vendor "Linux" for product "Linux Kernel" and version " < 5.10.79"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.14.18 Search vendor "Linux" for product "Linux Kernel" and version " < 5.14.18"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.15.2 Search vendor "Linux" for product "Linux Kernel" and version " < 5.15.2"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.16 Search vendor "Linux" for product "Linux Kernel" and version " < 5.16"		en		Affected