CVE-2021-47642

Severity CVSS v4.0:
Pending analysis
Type:
CWE-787 Out-of-bounds Write
Publication date:
26/02/2025
Last modified:
23/09/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow<br /> <br /> Coverity complains of a possible buffer overflow. However,<br /> given the &amp;#39;static&amp;#39; scope of nvidia_setup_i2c_bus() it looks<br /> like that can&amp;#39;t happen after examiniing the call sites.<br /> <br /> CID 19036 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)<br /> 1. fixed_size_dest: You might overrun the 48-character fixed-size string<br /> chan-&gt;adapter.name by copying name without checking the length.<br /> 2. parameter_as_source: Note: This defect has an elevated risk because the<br /> source argument is a parameter of the current function.<br /> 89 strcpy(chan-&gt;adapter.name, name);<br /> <br /> Fix this warning by using strscpy() which will silence the warning and<br /> prevent any future buffer overflows should the names used to identify the<br /> channel become much longer.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.9.311 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.10 (including) 4.14.276 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.15 (including) 4.19.238 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.20 (including) 5.4.189 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.110 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.33 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 5.16.19 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.17 (including) 5.17.2 (excluding)