CVE-2021-47172

Severity CVSS v4.0:
Pending analysis
Type:
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Publication date:
25/03/2024
Last modified:
30/04/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers<br /> <br /> Channel numbering must start at 0 and then not have any holes, or<br /> it is possible to overflow the available storage. Note this bug was<br /> introduced as part of a fix to ensure we didn&amp;#39;t rely on the ordering<br /> of child nodes. So we need to support arbitrary ordering but they all<br /> need to be there somewhere.<br /> <br /> Note I hit this when using qemu to test the rest of this series.<br /> Arguably this isn&amp;#39;t the best fix, but it is probably the most minimal<br /> option for backporting etc.<br /> <br /> Alexandru&amp;#39;s sign-off is here because he carried this patch in a larger<br /> set that Jonathan then applied.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.4.14 (including) 5.4.124 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.42 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.12.9 (excluding)
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*