CVE-2021-47274CWE-125

CVE-2021-47274

High · published May 21, 2024

CVSS v3.1
7.8
EPSS
1%
Percentile
54.6
In the wild
Unconfirmed
What it is

🚨 Memory corruption in the Linux kernel could lead to catastrophic system crashes, like a faulty wire in a power plant causing a blackout! 🔥 Think of it like a restaurant kitchen where an unqualified chef mixes up ingredients without measuring—one too many spices can ruin the entire dish! In this case, the ftrace buffer is overflowing and causing chaos in the system's memory management. An attacker could exploit this vulnerability to cause severe instability in the system, resulting in kernel crashes and potential data loss. Imagine your servers suddenly shutting down right at the peak load time—absolutely devastating!

Put simply

Think of it like a restaurant kitchen where an unqualified chef mixes up ingredients without measuring—one too many spices can ruin the entire dish! In this case, the ftrace buffer is overflowing and causing chaos in the system's memory management. This vulnerability allows for out-of-bounds memory writes in the Linux kernel due to improper length checks on tracing data. Specifically, the ftrace buffer does not adequately verify the bounds before writing, leading to memory corruption.

What to do

An attacker could exploit this vulnerability to cause severe instability in the system, resulting in kernel crashes and potential data loss. Imagine your servers suddenly shutting down right at the peak load time—absolutely devastating! Update your Linux kernel to version 4.19.232 or later to patch this vulnerability. It's crucial to review and implement proper memory handling practices to safeguard against similar issues in the future. You've got this! Follow these steps, and your system will be as secure as a fortress! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00754 · 54.6th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2024-05-21T19:15Z
Affected products (11)
ProductVersionsFixed in
linux/linux_kernel≥ 4.9.258, < 4.9.2734.9.273
linux/linux_kernel≥ 4.14.222, < 4.14.2374.14.237
linux/linux_kernel≥ 4.19.177, < 4.19.1954.19.195
linux/linux_kernel≥ 5.4.99, < 5.4.1265.4.126
linux/linux_kernel≥ 5.10.17, < 5.10.445.10.44
linux/linux_kernel≥ 5.11, < 5.12.115.12.11
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (14)
https://git.kernel.org/stable/c/2d598902799886d67947406f26ee8e5fd2ca097f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/31ceae385556c37e4d286cb6378696448f566883 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3e08a9f9760f4a70d633c328a76408e62d6f80a3 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/43c32c22254b9328d7abb1c2b0f689dc67838e60 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b16a249eca2230c2cd66fa1d4b94743bd9b6ef92 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d63f00ec908b3be635ead5d6029cc94246e1f38d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/edcce01e0e50840a9aa6a70baed21477bdd2c9f9 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2d598902799886d67947406f26ee8e5fd2ca097f · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/31ceae385556c37e4d286cb6378696448f566883 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/3e08a9f9760f4a70d633c328a76408e62d6f80a3 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/43c32c22254b9328d7abb1c2b0f689dc67838e60 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b16a249eca2230c2cd66fa1d4b94743bd9b6ef92 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/d63f00ec908b3be635ead5d6029cc94246e1f38d · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/edcce01e0e50840a9aa6a70baed21477bdd2c9f9 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 MAY 14:20Z
    tracing: Correct the length check which causes memory corruption
    cvelistv5