CVE-2021-47478: isofs: Fix out of bound access for corrupted isofs image

Critical severity · published May 22, 2024

CVE-2021-47478

isofs: Fix out of bound access for corrupted isofs image

9.1

CVSS

0.7%

EPSS

On KEV

Description

In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image When isofs image is suitably corrupted isofs_read_inode() can read data beyond the end of buffer. Sanity-check the directory entry length before using it.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 53% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Kernel · Linux

before 4.4.292; 4.5 before 4.9.290; 4.10 before 4.14.255; 4.15 before 4.19.217; 4.20 before 5.4.159; 5.5 before 5.10.79; +2 more · source: NVD

Linux · Linux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 156ce5bb6cc43a80a743810199defb1dc3f55b7f; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9ec33a9b8790c212cc926a88c5e2105f97f3f57e; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before afbd40f425227e661d991757e11cc4db024e761f; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b0ddff8d68f2e43857a84dce54c3deab181c8ae1; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6e80e9314f8bb52d9eabe1907698718ff01120f5; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 86d4aedcbc69c0f84551fb70f953c24e396de2d7; +4 more · source: vendor

Affected product

Kernel

Linux

All Kernel CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-47478

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-47478

Patch

https://git.kernel.org/stable/c/156ce5bb6cc43a80a743810199defb1dc3f55b7f

Patch