VDB

UBUNTU-CVE-2021-47576

UBUNTU-CVE-2021-47576 PUBLISHED CVSS 6.800000190734863 MEDIUM

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() In resp_mode_select() sanity check the block descriptor len to avoid UAF. BUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 Read of size 1 at addr ffff888026670f50 by task scsicmd/15032 CPU: 1 PID: 15032 Comm: scsicmd Not tainted 5.15.0-01d0625 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Call Trace: <TASK> dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:107 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:257 kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:443 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 schedule_resp+0x4af/0x1a10 drivers/scsi/scsi_debug.c:5483 scsi_debug_queuecommand+0x8c9/0x1e70 drivers/scsi/scsi_debug.c:7537 scsi_queue_rq+0x16b4/0x2d10 drivers/scsi/scsi_lib.c:1521 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1640 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358 __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1762 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1839 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:63 sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:837 sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:775 sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:941 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1166 __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:52 do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:50 entry_SYSCALL_64_after_hwframe+0x44/0xae arch/x86/entry/entry_64.S:113

Risk Scores

CVSS 4.0
6.800000190734863
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTSlinux-kvm4.4.0-1046.52, 4.4.0-1044.50, 4.4.0-1043.49
Ubuntu:Pro:14.04:LTSlinux-azure4.15.0-1082.92~14.04.1, 4.15.0-1089.99~14.04.1, 4.15.0-1091.101~14.04.1
Ubuntu:18.04:LTSlinux-azure-5.35.3.0-1035.36, 5.3.0-1034.35~18.04.1, 5.3.0-1032.33~18.04.1
Ubuntu:18.04:LTSlinux-gcp5.0.0-1025.26~18.04.1, 5.0.0-1021.21~18.04.1, 5.0.0-1020.20~18.04.1
Ubuntu:18.04:LTSlinux-hwe5.3.0-73.69, 0, 4.18.0-13.14~18.04.1
Ubuntu:18.04:LTSlinux-hwe-edge5.0.0-15.16~18.04.1, 0, 5.3.0-22.24~18.04.1
Ubuntu:Pro:FIPS-updates:18.04:LTSlinux-fips4.15.0-1056.64, 4.15.0-1055.63, 4.15.0-1054.62
Ubuntu:Pro:16.04:LTSlinux-azure4.15.0-1061.66, 4.15.0-1063.68, 4.15.0-1064.69
Ubuntu:Pro:FIPS:20.04:LTSlinux-fips0, 5.4.0-1007.8
Ubuntu:20.04:LTSlinux-kvm5.4.0-1034.35, 5.4.0-1036.37, 5.4.0-1037.38
Ubuntu:Pro:FIPS:18.04:LTSlinux-aws-fips0, 4.15.0-2000.4
Ubuntu:22.04:LTSlinux-azure-fde-6.26.2.0-1016.16~22.04.1.1, 6.2.0-1017.17~22.04.1.1, 6.2.0-1018.18~22.04.1.1
Ubuntu:20.04:LTSlinux-oem-5.65.6.0-1032.33, 5.6.0-1034.36, 5.6.0-1035.37
Ubuntu:20.04:LTSlinux-intel-5.135.13.0-1009.9, 5.13.0-1008.8, 5.13.0-1007.7
Ubuntu:20.04:LTSlinux-oracle5.4.0-1030.32, 5.4.0-1011.11, 5.4.0-1015.15
Ubuntu:Pro:FIPS-updates:20.04:LTSlinux-fips0, 5.4.0-1026.30, 5.4.0-1028.32
Ubuntu:18.04:LTSlinux-aws4.15.0-1067.71, 4.15.0-1016.16, 4.15.0-1011.11
Ubuntu:Pro:FIPS:18.04:LTSlinux-fips0, 4.15.0-1011.12
Ubuntu:Pro:FIPS-updates:20.04:LTSlinux-gcp-fips5.4.0-1021.21+fips1, 0
Ubuntu:18.04:LTSlinux-aws-5.45.4.0-1061.64~18.04.1, 0, 5.4.0-1018.18~18.04.1

…and 100 more

Timeline

  • Jun 19, 2024 CVE Published
  • Oct 28, 2026 CVE Updated
  • Oct 30, 2026 Distribution Patch
  • Oct 30, 2026 Distribution Patch
  • Oct 30, 2026 Distribution Patch
  • Oct 30, 2026 Security Advisory
  • Oct 30, 2026 Security Advisory
  • Oct 30, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›