CVE-2021-47404

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47404
In the Linux kernel, the following vulnerability has been resolved: HID: betop: fix slab-out-of-bounds Write in betop_probe Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1c83c38dec83d57bc18d0c01d82c413d3b34ccb9 Patch
https://git.kernel.org/stable/c/1e4ce418b1cb1a810256b5fb3fd33d22d1325993 Patch
https://git.kernel.org/stable/c/6fc4476dda58f6c00097c7ddec3b772513f57525 Patch
https://git.kernel.org/stable/c/708107b80aa616976d1c5fa60ac0c1390749db5e Patch
https://git.kernel.org/stable/c/a4faa7153b87fbcfe4be15f4278676f79ca6e019 Patch
https://git.kernel.org/stable/c/bb8b72374db69afa25a5b65cf1c092860c6fe914 Patch
https://git.kernel.org/stable/c/dedfc35a2de2bae9fa3da8210a05bfd515f83fee Patch
https://git.kernel.org/stable/c/fe9bb925e7096509711660d39c0493a1546e9550 Patch
https://git.kernel.org/stable/c/1c83c38dec83d57bc18d0c01d82c413d3b34ccb9 Patch
https://git.kernel.org/stable/c/1e4ce418b1cb1a810256b5fb3fd33d22d1325993 Patch
https://git.kernel.org/stable/c/6fc4476dda58f6c00097c7ddec3b772513f57525 Patch
https://git.kernel.org/stable/c/708107b80aa616976d1c5fa60ac0c1390749db5e Patch
https://git.kernel.org/stable/c/a4faa7153b87fbcfe4be15f4278676f79ca6e019 Patch
https://git.kernel.org/stable/c/bb8b72374db69afa25a5b65cf1c092860c6fe914 Patch
https://git.kernel.org/stable/c/dedfc35a2de2bae9fa3da8210a05bfd515f83fee Patch
https://git.kernel.org/stable/c/fe9bb925e7096509711660d39c0493a1546e9550 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
History

24 Dec 2024, 16:05

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux
CWE CWE-787
CPE cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/1c83c38dec83d57bc18d0c01d82c413d3b34ccb9 - () https://git.kernel.org/stable/c/1c83c38dec83d57bc18d0c01d82c413d3b34ccb9 - Patch
References () https://git.kernel.org/stable/c/1e4ce418b1cb1a810256b5fb3fd33d22d1325993 - () https://git.kernel.org/stable/c/1e4ce418b1cb1a810256b5fb3fd33d22d1325993 - Patch
References () https://git.kernel.org/stable/c/6fc4476dda58f6c00097c7ddec3b772513f57525 - () https://git.kernel.org/stable/c/6fc4476dda58f6c00097c7ddec3b772513f57525 - Patch
References () https://git.kernel.org/stable/c/708107b80aa616976d1c5fa60ac0c1390749db5e - () https://git.kernel.org/stable/c/708107b80aa616976d1c5fa60ac0c1390749db5e - Patch
References () https://git.kernel.org/stable/c/a4faa7153b87fbcfe4be15f4278676f79ca6e019 - () https://git.kernel.org/stable/c/a4faa7153b87fbcfe4be15f4278676f79ca6e019 - Patch
References () https://git.kernel.org/stable/c/bb8b72374db69afa25a5b65cf1c092860c6fe914 - () https://git.kernel.org/stable/c/bb8b72374db69afa25a5b65cf1c092860c6fe914 - Patch
References () https://git.kernel.org/stable/c/dedfc35a2de2bae9fa3da8210a05bfd515f83fee - () https://git.kernel.org/stable/c/dedfc35a2de2bae9fa3da8210a05bfd515f83fee - Patch
References () https://git.kernel.org/stable/c/fe9bb925e7096509711660d39c0493a1546e9550 - () https://git.kernel.org/stable/c/fe9bb925e7096509711660d39c0493a1546e9550 - Patch

21 Nov 2024, 06:36

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1c83c38dec83d57bc18d0c01d82c413d3b34ccb9 - () https://git.kernel.org/stable/c/1c83c38dec83d57bc18d0c01d82c413d3b34ccb9 -
References () https://git.kernel.org/stable/c/1e4ce418b1cb1a810256b5fb3fd33d22d1325993 - () https://git.kernel.org/stable/c/1e4ce418b1cb1a810256b5fb3fd33d22d1325993 -
References () https://git.kernel.org/stable/c/6fc4476dda58f6c00097c7ddec3b772513f57525 - () https://git.kernel.org/stable/c/6fc4476dda58f6c00097c7ddec3b772513f57525 -
References () https://git.kernel.org/stable/c/708107b80aa616976d1c5fa60ac0c1390749db5e - () https://git.kernel.org/stable/c/708107b80aa616976d1c5fa60ac0c1390749db5e -
References () https://git.kernel.org/stable/c/a4faa7153b87fbcfe4be15f4278676f79ca6e019 - () https://git.kernel.org/stable/c/a4faa7153b87fbcfe4be15f4278676f79ca6e019 -
References () https://git.kernel.org/stable/c/bb8b72374db69afa25a5b65cf1c092860c6fe914 - () https://git.kernel.org/stable/c/bb8b72374db69afa25a5b65cf1c092860c6fe914 -
References () https://git.kernel.org/stable/c/dedfc35a2de2bae9fa3da8210a05bfd515f83fee - () https://git.kernel.org/stable/c/dedfc35a2de2bae9fa3da8210a05bfd515f83fee -
References () https://git.kernel.org/stable/c/fe9bb925e7096509711660d39c0493a1546e9550 - () https://git.kernel.org/stable/c/fe9bb925e7096509711660d39c0493a1546e9550 -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: HID: betop: corrige escritura slab-out-of-bounds en betop_probe. Syzbot informó un error de escritura slab-out-of-bounds en el controlador hid-betopff. El problema es que el controlador supone que el dispositivo debe tener un informe de entrada, pero algunos dispositivos maliciosos violan esta suposición. Entonces, este parche verifica que la entrada de hid_device no esté vacía antes de usarse.

21 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-21 15:15

Updated : 2024-12-24 16:05

NVD link : CVE-2021-47404

Mitre link : CVE-2021-47404

CVE.ORG link : CVE-2021-47404

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write