CVE-2021-47605

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47605", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-24T15:11:00.737Z", "datePublished": "2024-06-19T14:54:04.323Z", "dateUpdated": "2026-08-05T08:48:35.224Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:35.224Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: fix memory corruption in vduse_dev_ioctl()\n\nThe \"config.offset\" comes from the user. There needs to a check to\nprevent it being out of bounds. The \"config.offset\" and\n\"dev->config_size\" variables are both type u32. So if the offset if\nout of bounds then the \"dev->config_size - config.offset\" subtraction\nresults in a very high u32 value. The out of bounds offset can result\nin memory corruption."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via the VDUSE_DEV_SET_CONFIG ioctl on the local char device /dev/vduse/$NAME (vduse_dev_ioctl), not via network packet processing or adjacent-link protocols.\nAC:L - The attacker fully controls config.offset, config.length, and the written buffer contents; a single ioctl with offset > config_size triggers the u32 underflow and OOB copy_from_user with no race or other external conditions.\nPR:L - There is no capable() check on this ioctl path, and VDUSE is explicitly designed so an unprivileged userspace process can open /dev/vduse/$NAME and drive the datapath/config updates.\nUI:N - Exploitation requires only issuing the malicious ioctl on an opened VDUSE device fd; no separate victim action is needed.\nS:U - Impact is host-kernel heap memory corruption from a local process in the same OS security authority, yielding privilege escalation rather than a cross-boundary VM/IOMMU escape.\nC:H - Attacker-controlled out-of-bounds write into kernel heap memory can be leveraged into arbitrary read primitives and full confidentiality compromise.\nI:H - The underflow allows copy_from_user of attacker-chosen data past the config buffer (heap OOB write), which is exploitable for arbitrary write and control-flow hijacking.\nA:H - The same memory corruption can cause kernel oops/panic or otherwise take down the system even when not fully exploited for code execution."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vdpa/vdpa_user/vduse_dev.c"], "versions": [{"version": "c8a6153b6c59d95c0e091f053f6f180952ade91e", "lessThan": "e6c67560b4341914bec32ec536e931c22062af65", "status": "affected", "versionType": "git"}, {"version": "c8a6153b6c59d95c0e091f053f6f180952ade91e", "lessThan": "ff9f9c6e74848170fcb45c8403c80d661484c8c9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vdpa/vdpa_user/vduse_dev.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.11", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e6c67560b4341914bec32ec536e931c22062af65"}, {"url": "https://git.kernel.org/stable/c/ff9f9c6e74848170fcb45c8403c80d661484c8c9"}], "title": "vduse: fix memory corruption in vduse_dev_ioctl()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:47:40.852Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e6c67560b4341914bec32ec536e931c22062af65", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ff9f9c6e74848170fcb45c8403c80d661484c8c9", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47605", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:12:11.197775Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:51.557Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e6c67560b4341914bec32ec536e931c22062af65", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ff9f9c6e74848170fcb45c8403c80d661484c8c9", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:47:40.852Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47605", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:12:11.197775Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:26.363Z"}}], "cna": {"title": "vduse: fix memory corruption in vduse_dev_ioctl()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via the VDUSE_DEV_SET_CONFIG ioctl on the local char device /dev/vduse/$NAME (vduse_dev_ioctl), not via network packet processing or adjacent-link protocols.\nAC:L - The attacker fully controls config.offset, config.length, and the written buffer contents; a single ioctl with offset > config_size triggers the u32 underflow and OOB copy_from_user with no race or other external conditions.\nPR:L - There is no capable() check on this ioctl path, and VDUSE is explicitly designed so an unprivileged userspace process can open /dev/vduse/$NAME and drive the datapath/config updates.\nUI:N - Exploitation requires only issuing the malicious ioctl on an opened VDUSE device fd; no separate victim action is needed.\nS:U - Impact is host-kernel heap memory corruption from a local process in the same OS security authority, yielding privilege escalation rather than a cross-boundary VM/IOMMU escape.\nC:H - Attacker-controlled out-of-bounds write into kernel heap memory can be leveraged into arbitrary read primitives and full confidentiality compromise.\nI:H - The underflow allows copy_from_user of attacker-chosen data past the config buffer (heap OOB write), which is exploitable for arbitrary write and control-flow hijacking.\nA:H - The same memory corruption can cause kernel oops/panic or otherwise take down the system even when not fully exploited for code execution."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c8a6153b6c59d95c0e091f053f6f180952ade91e", "lessThan": "e6c67560b4341914bec32ec536e931c22062af65", "versionType": "git"}, {"status": "affected", "version": "c8a6153b6c59d95c0e091f053f6f180952ade91e", "lessThan": "ff9f9c6e74848170fcb45c8403c80d661484c8c9", "versionType": "git"}], "programFiles": ["drivers/vdpa/vdpa_user/vduse_dev.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.11", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/vdpa/vdpa_user/vduse_dev.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e6c67560b4341914bec32ec536e931c22062af65"}, {"url": "https://git.kernel.org/stable/c/ff9f9c6e74848170fcb45c8403c80d661484c8c9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: fix memory corruption in vduse_dev_ioctl()\n\nThe \"config.offset\" comes from the user. There needs to a check to\nprevent it being out of bounds. The \"config.offset\" and\n\"dev->config_size\" variables are both type u32. So if the offset if\nout of bounds then the \"dev->config_size - config.offset\" subtraction\nresults in a very high u32 value. The out of bounds offset can result\nin memory corruption."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.11", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16", "versionStartIncluding": "5.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:35.224Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47605", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:48:35.224Z", "dateReserved": "2024-05-24T15:11:00.737Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-19T14:54:04.323Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/vdpa/vdpa_user/vduse_dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e6c67560b4341914bec32ec536e931c22062af65", "status": "affected", "version": "c8a6153b6c59d95c0e091f053f6f180952ade91e", "versionType": "git"}, {"lessThan": "ff9f9c6e74848170fcb45c8403c80d661484c8c9", "status": "affected", "version": "c8a6153b6c59d95c0e091f053f6f180952ade91e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/vdpa/vdpa_user/vduse_dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7A70FD7B-2EDC-4C3B-ADE0-880AA759CDD7", "versionEndExcluding": "5.15.11", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "357AA433-37E8-4323-BFB2-3038D6E4B414", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "A73429BA-C2D9-4D0C-A75F-06A1CA8B3983", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "F621B5E3-E99D-49E7-90B9-EC3B77C95383", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "F7BFDCAA-1650-49AA-8462-407DD593F94F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*", "matchCriteriaId": "6EC9882F-866D-4ACB-8FBC-213D8D8436C8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: fix memory corruption in vduse_dev_ioctl()\n\nThe \"config.offset\" comes from the user. There needs to a check to\nprevent it being out of bounds. The \"config.offset\" and\n\"dev->config_size\" variables are both type u32. So if the offset if\nout of bounds then the \"dev->config_size - config.offset\" subtraction\nresults in a very high u32 value. The out of bounds offset can result\nin memory corruption."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: vduse: corrige corrupci\u00f3n de memoria en vduse_dev_ioctl() El \"config.offset\" proviene del usuario. Es necesario realizar un control para evitar que est\u00e9 fuera de los l\u00edmites. Las variables \"config.offset\" y \"dev->config_size\" son ambas del tipo u32. Entonces, si el desplazamiento est\u00e1 fuera de los l\u00edmites, entonces la resta \"dev->config_size - config.offset\" da como resultado un valor u32 muy alto. El desplazamiento fuera de los l\u00edmites puede provocar da\u00f1os en la memoria."}], "id": "CVE-2021-47605", "lastModified": "2026-08-04T10:17:10.600", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47605", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:12:11.197775Z", "version": "2.0.3"}}]}, "published": "2024-06-19T15:15:55.067", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e6c67560b4341914bec32ec536e931c22062af65"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ff9f9c6e74848170fcb45c8403c80d661484c8c9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e6c67560b4341914bec32ec536e931c22062af65"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ff9f9c6e74848170fcb45c8403c80d661484c8c9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: vduse: fix memory corruption in vduse_dev_ioctl()", "id": "2293215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2293215"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-20->CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvduse: fix memory corruption in vduse_dev_ioctl()\nThe \"config.offset\" comes from the user. There needs to a check to\nprevent it being out of bounds. The \"config.offset\" and\n\"dev->config_size\" variables are both type u32. So if the offset if\nout of bounds then the \"dev->config_size - config.offset\" subtraction\nresults in a very high u32 value. The out of bounds offset can result\nin memory corruption.", "A flaw was found in the Linux kernel's vDPA framework. This flaw allows an attacker with sufficient privileges to cause system instability, potentially causing a denial of service."], "name": "CVE-2021-47605", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47605\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47605\nhttps://lore.kernel.org/linux-cve-announce/2024061923-CVE-2021-47605-3d20@gregkh/T"], "statement": "We do not believe Red Hat Enterprise Linux is vulnerable to this flaw, as the only products that contain the commit that introduced it also include the commit that fixed it.", "threat_severity": "Important"}

{}