CVE-2021-47006
ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook
Reported by linux · Published February 28, 2024
In the Linux kernel, the following vulnerability has been resolved: ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook The commit 1879445dfa7b ("perf/core: Set event's default ::overflow_handler()") set a default event->overflow_handler in perf_event_alloc(), and replace the check event->overflow_handler with is_default_overflow_handler(), but one is missing. Currently, the bp->overflow_handler can not be NULL. As a result, enable_single_step() is always not invoked. Comments from Zhen Lei: https://patchwork.kernel.org/project/linux-arm-kernel/patch/20210207105934.2001-1-thunder.leizhen@huawei.com/
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| perf | Amazon Linux | 4.14.238-182.421.amzn2 |
| python-perf | Amazon Linux | 4.14.238-182.421.amzn2 |
| kernel-tools-devel | Amazon Linux | 4.14.238-182.421.amzn2 |
| linux_kernel | linux | 5.12.5, 5.11.22, 5.10.38, 5.4.120, 4.19.191, 4.14.233, 4.9.269 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 1879445dfa7bbd6fe21b09c5cc72f4934798afed, 1879445dfa7bbd6fe21b09c5cc72f4934798afed, 1879445dfa7bbd6fe21b09c5cc72f4934798afed |
| Linux | Linux | 4.7, 0, 4.9.269 |
| amazon:2 | perf | 0 |
| amazon:2 | python-perf | 0 |
| amazon:2 | kernel-tools-devel | 0 |
| linux | linux_kernel | 4.7, 4.7, 4.7 |
| amazon:2 | kernel-headers | 0 |
| amazon:2 | kernel | 0 |
| amazon:2 | kernel-devel | 0 |
| amazon:2 | kernel-livepatch-4.14.238-182.421 | 0 |
| Linux | Linux | 5.12.5, 5.13, 5.10.38 |
| amazon:2 | kernel-tools | 0 |
Timeline
- Feb 28, 2024 CVE Published
- Feb 29, 2024 EPSS Score (30 in total, the first dated here)
- May 11, 2026 CVE Updated
- Jun 2, 2026 Security Advisory
- Jul 13, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-47006
vulnetix vdb fixes CVE-2021-47006Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-47006/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart