GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47219 (GCVE-0-2021-47219)

Vulnerability from cvelistv5 – Published: 2024-04-10 19:01 – Updated: 2026-08-05 08:46
VLAI
Title
scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() The following issue was observed running syzkaller: BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Read of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815 CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe4/0x14a lib/dump_stack.c:118 print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352 [inline] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:377 [inline] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429 scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034 __blk_run_queue_uncond block/blk-core.c:464 [inline] __blk_run_queue+0x1a4/0x380 block/blk-core.c:484 blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0 drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599 do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe We get 'alen' from command its type is int. If userspace passes a large length we will get a negative 'alen'. Switch n, alen, and rlen to u32.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-10 19:49 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5a09e39810ae0465016c380962e12dd115779b87 , < 8440377e1a5644779b4c8d013aa2a917f5fc83c3 (git)
Affected: 5a09e39810ae0465016c380962e12dd115779b87 , < 66523553fa62c7878fc5441dc4e82be71934eb77 (git)
Affected: 5a09e39810ae0465016c380962e12dd115779b87 , < f347c26836c270199de1599c3cd466bb7747caa9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.19
Unaffected: 0 , < 2.6.19 (semver)
Unaffected: 5.10.82 , ≤ 5.10.* (semver)
Unaffected: 5.15.5 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T19:49:13.779675Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:05.479Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.367Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8440377e1a5644779b4c8d013aa2a917f5fc83c3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/66523553fa62c7878fc5441dc4e82be71934eb77"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f347c26836c270199de1599c3cd466bb7747caa9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8440377e1a5644779b4c8d013aa2a917f5fc83c3",
              "status": "affected",
              "version": "5a09e39810ae0465016c380962e12dd115779b87",
              "versionType": "git"
            },
            {
              "lessThan": "66523553fa62c7878fc5441dc4e82be71934eb77",
              "status": "affected",
              "version": "5a09e39810ae0465016c380962e12dd115779b87",
              "versionType": "git"
            },
            {
              "lessThan": "f347c26836c270199de1599c3cd466bb7747caa9",
              "status": "affected",
              "version": "5a09e39810ae0465016c380962e12dd115779b87",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.82",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()\n\nThe following issue was observed running syzkaller:\n\nBUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline]\nBUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\nRead of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815\n\nCPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0xe4/0x14a lib/dump_stack.c:118\n print_address_description+0x73/0x280 mm/kasan/report.c:253\n kasan_report_error mm/kasan/report.c:352 [inline]\n kasan_report+0x272/0x370 mm/kasan/report.c:410\n memcpy+0x1f/0x50 mm/kasan/kasan.c:302\n memcpy include/linux/string.h:377 [inline]\n sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\n fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021\n resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772\n schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429\n scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835\n scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896\n scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034\n __blk_run_queue_uncond block/blk-core.c:464 [inline]\n __blk_run_queue+0x1a4/0x380 block/blk-core.c:484\n blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78\n sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847\n sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716\n sg_write+0x64/0xa0 drivers/scsi/sg.c:622\n __vfs_write+0xed/0x690 fs/read_write.c:485\nkill_bdev:block_device:00000000e138492c\n vfs_write+0x184/0x4c0 fs/read_write.c:549\n ksys_write+0x107/0x240 fs/read_write.c:599\n do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nWe get \u0027alen\u0027 from command its type is int. If userspace passes a large\nlength we will get a negative \u0027alen\u0027.\n\nSwitch n, alen, and rlen to u32."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local sg write/SG_IO on a scsi_debug /dev/sg device (sg_write \u2192 scsi_debug_queuecommand \u2192 resp_report_tgtpgs); scsi_debug is a host-side pseudo HBA and is not network-facing.\nAC:L - An attacker who can open the scsi_debug sg device can deterministically trigger the OOB by sending MAINTENANCE IN / REPORT TARGET PORT GROUPS with a CDB allocation length that has the high bit set, making signed alen negative; no race or unmanaged condition is required.\nPR:L - Once scsi_debug is loaded, MAINTENANCE_IN is permitted by scsi_cmd_allowed() without CAP_SYS_RAWIO to any process that can open /dev/sg* (e.g. disk-group membership), matching prior scsi_debug SG_IO scorings; full root is not required.\nUI:N - The attacker triggers the fault entirely by issuing their own write/SG_IO with a crafted CDB; no separate victim action is needed.\nS:U - Impact is confined to a kernel OOB read/oops within the same host OS security authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - Negative alen causes fill_from_dev_buffer()/sg_copy_from_buffer() to over-read past the 1412-byte kzalloc response buffer into adjacent slab memory and copy that data into the attacker-controlled SG data-in buffer, enabling substantial kernel memory disclosure.\nI:N - The corrupted length only drives sg_copy_from_buffer() (kernel-to-user read); there is no out-of-bounds write or other integrity/control-flow primitive in this path.\nA:H - With a large attacker-chosen DXFER length, the over-read can extend past mapped heap into a guard or unmapped page and cause a kernel oops/panic, fully disrupting availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:46.676Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8440377e1a5644779b4c8d013aa2a917f5fc83c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/66523553fa62c7878fc5441dc4e82be71934eb77"
        },
        {
          "url": "https://git.kernel.org/stable/c/f347c26836c270199de1599c3cd466bb7747caa9"
        }
      ],
      "title": "scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47219",
    "datePublished": "2024-04-10T19:01:57.694Z",
    "dateReserved": "2024-04-10T18:59:19.528Z",
    "dateUpdated": "2026-08-05T08:46:46.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47219",
      "date": "2026-09-16",
      "epss": "0.00247",
      "percentile": "0.16216"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()\\n\\nThe following issue was observed running syzkaller:\\n\\nBUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline]\\nBUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\\nRead of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815\\n\\nCPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\\nCall Trace:\\n __dump_stack lib/dump_stack.c:77 [inline]\\n dump_stack+0xe4/0x14a lib/dump_stack.c:118\\n print_address_description+0x73/0x280 mm/kasan/report.c:253\\n kasan_report_error mm/kasan/report.c:352 [inline]\\n kasan_report+0x272/0x370 mm/kasan/report.c:410\\n memcpy+0x1f/0x50 mm/kasan/kasan.c:302\\n memcpy include/linux/string.h:377 [inline]\\n sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\\n fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021\\n resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772\\n schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429\\n scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835\\n scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896\\n scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034\\n __blk_run_queue_uncond block/blk-core.c:464 [inline]\\n __blk_run_queue+0x1a4/0x380 block/blk-core.c:484\\n blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78\\n sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847\\n sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716\\n sg_write+0x64/0xa0 drivers/scsi/sg.c:622\\n __vfs_write+0xed/0x690 fs/read_write.c:485\\nkill_bdev:block_device:00000000e138492c\\n vfs_write+0x184/0x4c0 fs/read_write.c:549\\n ksys_write+0x107/0x240 fs/read_write.c:599\\n do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293\\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\\n\\nWe get \u0027alen\u0027 from command its type is int. If userspace passes a large\\nlength we will get a negative \u0027alen\u0027.\\n\\nSwitch n, alen, and rlen to u32.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: scsi_debug: Corregir lectura fuera de los l\\u00edmites en resp_report_tgtpgs() Se observ\\u00f3 el siguiente problema al ejecutar syzkaller: ERROR: KASAN: slab-out-of-bounds en memcpy include/linux/string.h:377 [en l\\u00ednea] ERROR: KASAN: slab-out-of-bounds en sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Lectura de tama\\u00f1o 2132 en la direcci\\u00f3n ffff8880aea95dc8 por la tarea syz-executor.0/9815 CPU: 0 PID: 9815 Comm: syz-executor.0 No contaminado 4.19.202-00874-gfc0fe04215a9 #2 Nombre del hardware: PC est\\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 01/04/2014 Seguimiento de llamadas: __dump_stack lib/dump_stack.c:77 [en l\\u00ednea] dump_stack+0xe4/0x14a lib/dump_stack.c:118 print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352 [en l\\u00ednea] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:377 [en l\\u00ednea] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 rellenar_desde_buffer_dev+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429 scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034 __blk_run_queue_uncond bloque/blk-core.c:464 [en l\\u00ednea] __blk_run_queue+0x1a4/0x380 bloque/blk-core.c:484 blk_execute_rq_nowait+0x1c2/0x2d0 bloque/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0 drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599 do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe Obtenemos \u0027alen\u0027 del comando, su tipo es int. Si el espacio de usuario pasa una longitud grande, obtendremos un \u0027alen\u0027 negativo. Cambie n, alen y rlen a u32.\"}]",
      "id": "CVE-2021-47219",
      "lastModified": "2024-11-21T06:35:39.137",
      "published": "2024-04-10T19:15:48.903",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/66523553fa62c7878fc5441dc4e82be71934eb77\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8440377e1a5644779b4c8d013aa2a917f5fc83c3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f347c26836c270199de1599c3cd466bb7747caa9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/66523553fa62c7878fc5441dc4e82be71934eb77\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8440377e1a5644779b4c8d013aa2a917f5fc83c3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f347c26836c270199de1599c3cd466bb7747caa9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47219\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-10T19:15:48.903\",\"lastModified\":\"2026-08-04T10:16:53.023\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()\\n\\nThe following issue was observed running syzkaller:\\n\\nBUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline]\\nBUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\\nRead of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815\\n\\nCPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\\nCall Trace:\\n __dump_stack lib/dump_stack.c:77 [inline]\\n dump_stack+0xe4/0x14a lib/dump_stack.c:118\\n print_address_description+0x73/0x280 mm/kasan/report.c:253\\n kasan_report_error mm/kasan/report.c:352 [inline]\\n kasan_report+0x272/0x370 mm/kasan/report.c:410\\n memcpy+0x1f/0x50 mm/kasan/kasan.c:302\\n memcpy include/linux/string.h:377 [inline]\\n sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\\n fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021\\n resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772\\n schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429\\n scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835\\n scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896\\n scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034\\n __blk_run_queue_uncond block/blk-core.c:464 [inline]\\n __blk_run_queue+0x1a4/0x380 block/blk-core.c:484\\n blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78\\n sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847\\n sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716\\n sg_write+0x64/0xa0 drivers/scsi/sg.c:622\\n __vfs_write+0xed/0x690 fs/read_write.c:485\\nkill_bdev:block_device:00000000e138492c\\n vfs_write+0x184/0x4c0 fs/read_write.c:549\\n ksys_write+0x107/0x240 fs/read_write.c:599\\n do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293\\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\\n\\nWe get \u0027alen\u0027 from command its type is int. If userspace passes a large\\nlength we will get a negative \u0027alen\u0027.\\n\\nSwitch n, alen, and rlen to u32.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: scsi_debug: Corregir lectura fuera de los l\u00edmites en resp_report_tgtpgs() Se observ\u00f3 el siguiente problema al ejecutar syzkaller: ERROR: KASAN: slab-out-of-bounds en memcpy include/linux/string.h:377 [en l\u00ednea] ERROR: KASAN: slab-out-of-bounds en sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Lectura de tama\u00f1o 2132 en la direcci\u00f3n ffff8880aea95dc8 por la tarea syz-executor.0/9815 CPU: 0 PID: 9815 Comm: syz-executor.0 No contaminado 4.19.202-00874-gfc0fe04215a9 #2 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 01/04/2014 Seguimiento de llamadas: __dump_stack lib/dump_stack.c:77 [en l\u00ednea] dump_stack+0xe4/0x14a lib/dump_stack.c:118 print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352 [en l\u00ednea] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:377 [en l\u00ednea] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 rellenar_desde_buffer_dev+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429 scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034 __blk_run_queue_uncond bloque/blk-core.c:464 [en l\u00ednea] __blk_run_queue+0x1a4/0x380 bloque/blk-core.c:484 blk_execute_rq_nowait+0x1c2/0x2d0 bloque/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0 drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599 do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe Obtenemos \u0027alen\u0027 del comando, su tipo es int. Si el espacio de usuario pasa una longitud grande, obtendremos un \u0027alen\u0027 negativo. Cambie n, alen y rlen a u32.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/scsi_debug.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5a09e39810ae0465016c380962e12dd115779b87\",\"lessThan\":\"8440377e1a5644779b4c8d013aa2a917f5fc83c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a09e39810ae0465016c380962e12dd115779b87\",\"lessThan\":\"66523553fa62c7878fc5441dc4e82be71934eb77\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a09e39810ae0465016c380962e12dd115779b87\",\"lessThan\":\"f347c26836c270199de1599c3cd466bb7747caa9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/scsi_debug.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.82\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.5\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-10T19:49:13.779675Z\",\"id\":\"CVE-2021-47219\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.82\",\"matchCriteriaId\":\"49103CD7-A3F7-441A-AAF4-11B8B707979D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.5\",\"matchCriteriaId\":\"2128A085-4C0C-4C1E-9E9C-0DD868E2170F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/66523553fa62c7878fc5441dc4e82be71934eb77\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8440377e1a5644779b4c8d013aa2a917f5fc83c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f347c26836c270199de1599c3cd466bb7747caa9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66523553fa62c7878fc5441dc4e82be71934eb77\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8440377e1a5644779b4c8d013aa2a917f5fc83c3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f347c26836c270199de1599c3cd466bb7747caa9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:03:29+00:00",
      "cve": "CVE-2021-47219",
      "id": "CVE-2021-47219",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47219.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:29:07Z",
      "cve": "CVE-2021-47219",
      "id": "CVE-2021-47219",
      "initial_release_date": "2024-04-15T23:20:41Z",
      "product_status:known_affected": "371",
      "product_status:known_not_affected": "69",
      "product_status:recommended": "706",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47219",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47219.json",
      "version": "63"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8440377e1a5644779b4c8d013aa2a917f5fc83c3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/66523553fa62c7878fc5441dc4e82be71934eb77\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f347c26836c270199de1599c3cd466bb7747caa9\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.367Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47219\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-10T19:49:13.779675Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:23.138Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only via local sg write/SG_IO on a scsi_debug /dev/sg device (sg_write \\u2192 scsi_debug_queuecommand \\u2192 resp_report_tgtpgs); scsi_debug is a host-side pseudo HBA and is not network-facing.\\nAC:L - An attacker who can open the scsi_debug sg device can deterministically trigger the OOB by sending MAINTENANCE IN / REPORT TARGET PORT GROUPS with a CDB allocation length that has the high bit set, making signed alen negative; no race or unmanaged condition is required.\\nPR:L - Once scsi_debug is loaded, MAINTENANCE_IN is permitted by scsi_cmd_allowed() without CAP_SYS_RAWIO to any process that can open /dev/sg* (e.g. disk-group membership), matching prior scsi_debug SG_IO scorings; full root is not required.\\nUI:N - The attacker triggers the fault entirely by issuing their own write/SG_IO with a crafted CDB; no separate victim action is needed.\\nS:U - Impact is confined to a kernel OOB read/oops within the same host OS security authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\\nC:H - Negative alen causes fill_from_dev_buffer()/sg_copy_from_buffer() to over-read past the 1412-byte kzalloc response buffer into adjacent slab memory and copy that data into the attacker-controlled SG data-in buffer, enabling substantial kernel memory disclosure.\\nI:N - The corrupted length only drives sg_copy_from_buffer() (kernel-to-user read); there is no out-of-bounds write or other integrity/control-flow primitive in this path.\\nA:H - With a large attacker-chosen DXFER length, the over-read can extend past mapped heap into a guard or unmapped page and cause a kernel oops/panic, fully disrupting availability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5a09e39810ae0465016c380962e12dd115779b87\", \"lessThan\": \"8440377e1a5644779b4c8d013aa2a917f5fc83c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5a09e39810ae0465016c380962e12dd115779b87\", \"lessThan\": \"66523553fa62c7878fc5441dc4e82be71934eb77\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5a09e39810ae0465016c380962e12dd115779b87\", \"lessThan\": \"f347c26836c270199de1599c3cd466bb7747caa9\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/scsi/scsi_debug.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.82\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/scsi/scsi_debug.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8440377e1a5644779b4c8d013aa2a917f5fc83c3\"}, {\"url\": \"https://git.kernel.org/stable/c/66523553fa62c7878fc5441dc4e82be71934eb77\"}, {\"url\": \"https://git.kernel.org/stable/c/f347c26836c270199de1599c3cd466bb7747caa9\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()\\n\\nThe following issue was observed running syzkaller:\\n\\nBUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline]\\nBUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\\nRead of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815\\n\\nCPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\\nCall Trace:\\n __dump_stack lib/dump_stack.c:77 [inline]\\n dump_stack+0xe4/0x14a lib/dump_stack.c:118\\n print_address_description+0x73/0x280 mm/kasan/report.c:253\\n kasan_report_error mm/kasan/report.c:352 [inline]\\n kasan_report+0x272/0x370 mm/kasan/report.c:410\\n memcpy+0x1f/0x50 mm/kasan/kasan.c:302\\n memcpy include/linux/string.h:377 [inline]\\n sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\\n fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021\\n resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772\\n schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429\\n scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835\\n scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896\\n scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034\\n __blk_run_queue_uncond block/blk-core.c:464 [inline]\\n __blk_run_queue+0x1a4/0x380 block/blk-core.c:484\\n blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78\\n sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847\\n sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716\\n sg_write+0x64/0xa0 drivers/scsi/sg.c:622\\n __vfs_write+0xed/0x690 fs/read_write.c:485\\nkill_bdev:block_device:00000000e138492c\\n vfs_write+0x184/0x4c0 fs/read_write.c:549\\n ksys_write+0x107/0x240 fs/read_write.c:599\\n do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293\\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\\n\\nWe get \u0027alen\u0027 from command its type is int. If userspace passes a large\\nlength we will get a negative \u0027alen\u0027.\\n\\nSwitch n, alen, and rlen to u32.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.82\", \"versionStartIncluding\": \"2.6.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.5\", \"versionStartIncluding\": \"2.6.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"2.6.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:46.676Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47219\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:46.676Z\", \"dateReserved\": \"2024-04-10T18:59:19.528Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-10T19:01:57.694Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.