CVE-2021-47485

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47485", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-22T06:20:56.201Z", "datePublished": "2024-05-22T08:19:36.158Z", "dateUpdated": "2026-08-05T08:48:01.651Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:01.651Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\n\nOverflowing either addrlimit or bytes_togo can allow userspace to trigger\na buffer overflow of kernel memory. Check for overflows in all the places\ndoing math on user controlled buffers."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via local writev/write_iter on the qib char device (/dev/ipath) after context assignment; it is not triggered by remote InfiniBand packet processing.\nAC:L - The attacker fully controls iovec lengths and PBC/header fields that drive the overflowing arithmetic, so the heap overflow can be triggered reliably once the QIB device is present and SDMA is running.\nPR:L - No capabilities are checked on the open/assign/writev path; access is only gated by /dev/ipath permissions, and this userspace SDMA interface is intended for unprivileged PSM/MPI processes on systems with the HCA.\nUI:N - The attacker opens the device and issues crafted write/writev calls themselves; no separate victim action is required.\nS:U - Impact is kernel memory corruption and privilege escalation on the same host authority, not a cross-boundary escape (VM/IOMMU/sandbox).\nC:H - A controllable kernel heap buffer overflow can be leveraged for arbitrary kernel memory disclosure.\nI:H - Kernel heap overflow of qib_user_sdma_pkt addr[]/adjacent memory enables arbitrary write and control-flow hijacking for full integrity compromise.\nA:H - The same heap corruption can cause kernel oops/panic or hang, fully impacting availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/qib/qib_user_sdma.c"], "versions": [{"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "bda41654b6e0c125a624ca35d6d20beb8015b5d0", "status": "affected", "versionType": "git"}, {"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "3f57c3f67fd93b4da86aeffea1ca32c484d054ad", "status": "affected", "versionType": "git"}, {"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "60833707b968d5ae02a75edb7886dcd4a957cf0d", "status": "affected", "versionType": "git"}, {"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "73d2892148aa4397a885b4f4afcfc5b27a325c42", "status": "affected", "versionType": "git"}, {"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "0f8cdfff06829a0b0348b6debc29ff6a61967724", "status": "affected", "versionType": "git"}, {"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "c3e17e58f571f34c51aeb17274ed02c2ed5cf780", "status": "affected", "versionType": "git"}, {"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "0d4395477741608d123dad51def9fe50b7ebe952", "status": "affected", "versionType": "git"}, {"version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "d39bf40e55e666b5905fdbd46a0dced030ce87be", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/qib/qib_user_sdma.c"], "versions": [{"version": "2.6.35", "status": "affected"}, {"version": "0", "lessThan": "2.6.35", "status": "unaffected", "versionType": "semver"}, {"version": "4.4.292", "lessThanOrEqual": "4.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.290", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.255", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.216", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.157", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.77", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.14.16", "lessThanOrEqual": "5.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "4.4.292"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "4.9.290"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "4.14.255"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "4.19.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.4.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.10.77"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.14.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0"}, {"url": "https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad"}, {"url": "https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d"}, {"url": "https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42"}, {"url": "https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724"}, {"url": "https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780"}, {"url": "https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952"}, {"url": "https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be"}], "title": "IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47485", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-22T18:45:08.968768Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:14:26.389Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.745Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.745Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47485", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-22T18:45:08.968768Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-22T18:45:18.857Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via local writev/write_iter on the qib char device (/dev/ipath) after context assignment; it is not triggered by remote InfiniBand packet processing.\nAC:L - The attacker fully controls iovec lengths and PBC/header fields that drive the overflowing arithmetic, so the heap overflow can be triggered reliably once the QIB device is present and SDMA is running.\nPR:L - No capabilities are checked on the open/assign/writev path; access is only gated by /dev/ipath permissions, and this userspace SDMA interface is intended for unprivileged PSM/MPI processes on systems with the HCA.\nUI:N - The attacker opens the device and issues crafted write/writev calls themselves; no separate victim action is required.\nS:U - Impact is kernel memory corruption and privilege escalation on the same host authority, not a cross-boundary escape (VM/IOMMU/sandbox).\nC:H - A controllable kernel heap buffer overflow can be leveraged for arbitrary kernel memory disclosure.\nI:H - Kernel heap overflow of qib_user_sdma_pkt addr[]/adjacent memory enables arbitrary write and control-flow hijacking for full integrity compromise.\nA:H - The same heap corruption can cause kernel oops/panic or hang, fully impacting availability."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "bda41654b6e0c125a624ca35d6d20beb8015b5d0", "versionType": "git"}, {"status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "3f57c3f67fd93b4da86aeffea1ca32c484d054ad", "versionType": "git"}, {"status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "60833707b968d5ae02a75edb7886dcd4a957cf0d", "versionType": "git"}, {"status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "73d2892148aa4397a885b4f4afcfc5b27a325c42", "versionType": "git"}, {"status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "0f8cdfff06829a0b0348b6debc29ff6a61967724", "versionType": "git"}, {"status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "c3e17e58f571f34c51aeb17274ed02c2ed5cf780", "versionType": "git"}, {"status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "0d4395477741608d123dad51def9fe50b7ebe952", "versionType": "git"}, {"status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "lessThan": "d39bf40e55e666b5905fdbd46a0dced030ce87be", "versionType": "git"}], "programFiles": ["drivers/infiniband/hw/qib/qib_user_sdma.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.35"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.35", "versionType": "semver"}, {"status": "unaffected", "version": "4.4.292", "versionType": "semver", "lessThanOrEqual": "4.4.*"}, {"status": "unaffected", "version": "4.9.290", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.255", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.216", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.157", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.77", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.14.16", "versionType": "semver", "lessThanOrEqual": "5.14.*"}, {"status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/hw/qib/qib_user_sdma.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0"}, {"url": "https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad"}, {"url": "https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d"}, {"url": "https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42"}, {"url": "https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724"}, {"url": "https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780"}, {"url": "https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952"}, {"url": "https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\n\nOverflowing either addrlimit or bytes_togo can allow userspace to trigger\na buffer overflow of kernel memory. Check for overflows in all the places\ndoing math on user controlled buffers."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.4.292", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.290", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.255", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.216", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.157", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.77", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.14.16", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15", "versionStartIncluding": "2.6.35"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:01.651Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47485", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:48:01.651Z", "dateReserved": "2024-05-22T06:20:56.201Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-22T08:19:36.158Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/qib/qib_user_sdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bda41654b6e0c125a624ca35d6d20beb8015b5d0", "status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "versionType": "git"}, {"lessThan": "3f57c3f67fd93b4da86aeffea1ca32c484d054ad", "status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "versionType": "git"}, {"lessThan": "60833707b968d5ae02a75edb7886dcd4a957cf0d", "status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "versionType": "git"}, {"lessThan": "73d2892148aa4397a885b4f4afcfc5b27a325c42", "status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "versionType": "git"}, {"lessThan": "0f8cdfff06829a0b0348b6debc29ff6a61967724", "status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "versionType": "git"}, {"lessThan": "c3e17e58f571f34c51aeb17274ed02c2ed5cf780", "status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "versionType": "git"}, {"lessThan": "0d4395477741608d123dad51def9fe50b7ebe952", "status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "versionType": "git"}, {"lessThan": "d39bf40e55e666b5905fdbd46a0dced030ce87be", "status": "affected", "version": "f931551bafe1f10ded7f5282e2aa162c267a2e5d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/qib/qib_user_sdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.35"}, {"lessThan": "2.6.35", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.4.*", "status": "unaffected", "version": "4.4.292", "versionType": "semver"}, {"lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.290", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.255", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.216", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.157", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.77", "versionType": "semver"}, {"lessThanOrEqual": "5.14.*", "status": "unaffected", "version": "5.14.16", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3AEC86A-6474-4042-91D8-DD381C1F06DF", "versionEndExcluding": "4.4.292", "versionStartIncluding": "2.6.35", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "85D8337A-4EA1-4787-85EA-4BF4328A9436", "versionEndExcluding": "4.9.290", "versionStartIncluding": "4.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "436BD498-0DB1-4290-9A36-A52CB11B3AC3", "versionEndExcluding": "4.14.255", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0F384B60-1DBA-4E2B-9110-0087D95F30DB", "versionEndExcluding": "4.19.216", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8FBCA21B-424F-4B7F-A9A8-FDD64FE6BD3B", "versionEndExcluding": "5.4.157", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "26EB7ED9-AEA3-4829-8B5E-08571262F72A", "versionEndExcluding": "5.10.77", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2681B950-4548-4649-A9E1-4124B59FC09C", "versionEndExcluding": "5.14.16", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "E46C74C6-B76B-4C94-A6A4-FD2FFF62D644", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "60134C3A-06E4-48C1-B04F-2903732A4E56", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "0460DA88-8FE1-46A2-9DDA-1F1ABA552E71", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "AF55383D-4DF2-45DC-93F7-571F4F978EAB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*", "matchCriteriaId": "9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*", "matchCriteriaId": "EBD45831-4B79-42BC-ABC0-86870F0DEA89", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*", "matchCriteriaId": "948A6B8D-1B72-4945-8680-354E53BE1C80", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\n\nOverflowing either addrlimit or bytes_togo can allow userspace to trigger\na buffer overflow of kernel memory. Check for overflows in all the places\ndoing math on user controlled buffers."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: IB/qib: Protege contra el desbordamiento del b\u00fafer en los campos de struct qib_user_sdma_pkt. El desbordamiento de addrlimit o bytes_togo puede permitir que el espacio de usuario desencadene un desbordamiento del b\u00fafer de la memoria del kernel. Compruebe si hay desbordamientos en todos los lugares que realizan c\u00e1lculos en b\u00faferes controlados por el usuario."}], "id": "CVE-2021-47485", "lastModified": "2026-08-04T10:17:05.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47485", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-22T18:45:08.968768Z", "version": "2.0.3"}}]}, "published": "2024-05-22T09:15:10.503", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields", "id": "2282937", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282937"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-190->CWE-120", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nIB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\nOverflowing either addrlimit or bytes_togo can allow userspace to trigger\na buffer overflow of kernel memory. Check for overflows in all the places\ndoing math on user controlled buffers."], "name": "CVE-2021-47485", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47485\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47485\nhttps://lore.kernel.org/linux-cve-announce/2024052239-CVE-2021-47485-4584@gregkh/T"], "threat_severity": "Low"}

{}