CVE-2021-47276

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/05/2024
Last modified:
30/04/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ftrace: Do not blindly read the ip address in ftrace_bug()<br /> <br /> It was reported that a bug on arm64 caused a bad ip address to be used for<br /> updating into a nop in ftrace_init(), but the error path (rightfully)<br /> returned -EINVAL and not -EFAULT, as the bug caused more than one error to<br /> occur. But because -EINVAL was returned, the ftrace_bug() tried to report<br /> what was at the location of the ip address, and read it directly. This<br /> caused the machine to panic, as the ip was not pointing to a valid memory<br /> address.<br /> <br /> Instead, read the ip address with copy_from_kernel_nofault() to safely<br /> access the memory, and if it faults, report that the address faulted,<br /> otherwise report what was in that location.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 2.6.28 (including) 4.4.273 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.5 (including) 4.9.273 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.10 (including) 4.14.237 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.15 (including) 4.19.195 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.20 (including) 5.4.126 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.44 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.12.11 (excluding)
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*