CVE-2021-47153CWE-125

CVE-2021-47153

High · published March 25, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

i2c: i801: Don't generate an interrupt on bus reset

Now that the i2c-i801 driver supports interrupts, setting the KILL bit

in a attempt to recover from a timed out transaction triggers an

interrupt. Unfortunately, the interrupt handler (i801_isr) is not

prepared for this situation and will try to process the interrupt as

if it was signaling the end of a successful transaction. In the case

of a block transaction, this can result in an out-of-range memory

access.

This condition was reproduced several times by syzbot:

https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e

https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e

https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e

https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb

https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a

https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79

So disable interrupts while trying to reset the bus. Interrupts will

be enabled again for the following transaction.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.3th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2024-03-25T13:15Z
Affected products (10)
ProductVersionsFixed in
linux/linux_kernel≥ 3.6, < 4.4.2714.4.271
linux/linux_kernel≥ 4.5, < 4.9.2714.9.271
linux/linux_kernel≥ 4.10, < 4.14.2354.14.235
linux/linux_kernel≥ 4.15, < 4.19.1934.19.193
linux/linux_kernel≥ 4.20, < 5.4.1245.4.124
linux/linux_kernel≥ 5.5, < 5.10.425.10.42
linux/linux_kernel≥ 5.11, < 5.12.95.12.9
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (16)
https://git.kernel.org/stable/c/04cc05e3716ae31b17ecdab7bc55c8170def1b8b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/09c9e79f4c10cfb6b9e0e1b4dd355232e4b5a3b3 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1f583d3813f204449037cd2acbfc09168171362a · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b523feb7e8e44652f92f3babb953a976e7ccbbef · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c70e1ba2e7e65255a0ce004f531dd90dada97a8c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dfa8929e117b0228a7765f5c3f5988a4a028f3c6 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e4d8716c3dcec47f1557024add24e1f3c09eb24b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f9469082126cebb7337db3992d143f5e4edfe629 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/04cc05e3716ae31b17ecdab7bc55c8170def1b8b · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/09c9e79f4c10cfb6b9e0e1b4dd355232e4b5a3b3 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/1f583d3813f204449037cd2acbfc09168171362a · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b523feb7e8e44652f92f3babb953a976e7ccbbef · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/c70e1ba2e7e65255a0ce004f531dd90dada97a8c · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/dfa8929e117b0228a7765f5c3f5988a4a028f3c6 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/e4d8716c3dcec47f1557024add24e1f3c09eb24b · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/f9469082126cebb7337db3992d143f5e4edfe629 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 MAR 09:07Z
    i2c: i801: Don't generate an interrupt on bus reset
    cvelistv5