Buffer overflow in Linux
CVE-2021-47040
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix overflows checks in provide buffers Colin reported before possible overflow and sign extension problems in io_provide_buffers_prep(). As Linus pointed out previous attempt did nothing useful, see d81269fecb8ce ("io_uring: fix provide_buffers sign extension"). Do that with help of check_<op>_overflow helpers. And fix struct io_provide_buf::len type, as it doesn't make much sense to keep it signed.
Vulnerability class: Buffer Overflow
EPSS: 0.003 (17.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linux — versions efe68c1ca8f49e8c06afd74b699411bfbb8ba1ff, 5.8, 0
- Linux Linux_kernel
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2021-47040?
- CVE-2021-47040 is a high-severity vulnerability in Linux, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 7.8/10. Published 2024-02-28.
- How severe is CVE-2021-47040?
- High severity. CVSS v3 base score is 7.8 out of 10.