CVE-2021-47148 - octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context()

Back Back to CVE browser

HIGH

octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context()

Published Mar 25, 2024

7.8

HIGH

CVSS 3.1

EPSS 0.24%

Description

This function is called from ethtool_set_rxfh() and "*rss_context" comes from the user. Add some bounds checking to prevent memory corruption.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  5.12
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.12
- Version
  5.12.9
  Status
  unaffected
  Constraints
  <=5.12.*
- Version
  5.13
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected

Linux

affected

Version	Status	Constraints
5.12	affected	-
0	unaffected	<5.12
5.12.9	unaffected	<=5.12.*
5.13	unaffected	<=*

Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Remediation

Red Hat mitigation

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-787

Out-of-bounds Write

References (8)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2021-47148		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2271495		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-33796		Advisory
https://git.kernel.org/stable/c/389146bc6d2bbb20714d06624b74856320ce40f7		Patch
https://git.kernel.org/stable/c/e5cc361e21648b75f935f9571d4003aaee480214		Patch
https://lore.kernel.org/linux-cve-announce/2024032559-CVE-2021-47148-502f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2021-47148
https://www.cve.org/CVERecord?id=CVE-2021-47148