GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47636 (GCVE-0-2021-47636)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2026-08-05 08:48
VLAI
Title
ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
Summary
In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() Function ubifs_wbuf_write_nolock() may access buf out of bounds in following process: ubifs_wbuf_write_nolock(): aligned_len = ALIGN(len, 8); // Assume len = 4089, aligned_len = 4096 if (aligned_len <= wbuf->avail) ... // Not satisfy if (wbuf->used) { ubifs_leb_write() // Fill some data in avail wbuf len -= wbuf->avail; // len is still not 8-bytes aligned aligned_len -= wbuf->avail; } n = aligned_len >> c->max_write_shift; if (n) { n <<= c->max_write_shift; err = ubifs_leb_write(c, wbuf->lnum, buf + written, wbuf->offs, n); // n > len, read out of bounds less than 8(n-len) bytes } , which can be catched by KASAN: ========================================================= BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0 Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128 Workqueue: writeback wb_workfn (flush-ubifs_0_0) Call Trace: kasan_report.cold+0x81/0x165 nand_write_page_swecc+0xa9/0x160 ubifs_leb_write+0xf2/0x1b0 [ubifs] ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs] write_head+0xdc/0x1c0 [ubifs] ubifs_jnl_write_inode+0x627/0x960 [ubifs] wb_workfn+0x8af/0xb80 Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8 bytes aligned, the 'len' represents the true length of buf (which is allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully to write leb safely. Fetch a reproducer in [Link].
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:50 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 5343575aa11c5d7044107d59d43f84aec01312b0 (git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < b80ccbec0e4804436c382d7dd60e943c386ed83a (git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 07a209fadee7b53b46858538e1177597273862e4 (git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < a7054aaf1909cf40489c0ec1b728fdcf79c751a6 (git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < e09fa5318d51f522e1af4fbaf8f74999355980c8 (git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 3b7fb89135a20587d57f8877c02e25003e9edbdf (git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 4f2262a334641e05f645364d5ade1f565c85f20b (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.27
Unaffected: 0 , < 2.6.27 (semver)
Unaffected: 4.19.238 , ≤ 4.19.* (semver)
Unaffected: 5.4.189 , ≤ 5.4.* (semver)
Unaffected: 5.10.110 , ≤ 5.10.* (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47636",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:50:54.449259Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:08.785Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ubifs/io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5343575aa11c5d7044107d59d43f84aec01312b0",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            },
            {
              "lessThan": "b80ccbec0e4804436c382d7dd60e943c386ed83a",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            },
            {
              "lessThan": "07a209fadee7b53b46858538e1177597273862e4",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            },
            {
              "lessThan": "a7054aaf1909cf40489c0ec1b728fdcf79c751a6",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            },
            {
              "lessThan": "e09fa5318d51f522e1af4fbaf8f74999355980c8",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            },
            {
              "lessThan": "3b7fb89135a20587d57f8877c02e25003e9edbdf",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            },
            {
              "lessThan": "4f2262a334641e05f645364d5ade1f565c85f20b",
              "status": "affected",
              "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ubifs/io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.238",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.189",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.110",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()\n\nFunction ubifs_wbuf_write_nolock() may access buf out of bounds in\nfollowing process:\n\nubifs_wbuf_write_nolock():\n  aligned_len = ALIGN(len, 8);   // Assume len = 4089, aligned_len = 4096\n  if (aligned_len \u003c= wbuf-\u003eavail) ... // Not satisfy\n  if (wbuf-\u003eused) {\n    ubifs_leb_write()  // Fill some data in avail wbuf\n    len -= wbuf-\u003eavail;   // len is still not 8-bytes aligned\n    aligned_len -= wbuf-\u003eavail;\n  }\n  n = aligned_len \u003e\u003e c-\u003emax_write_shift;\n  if (n) {\n    n \u003c\u003c= c-\u003emax_write_shift;\n    err = ubifs_leb_write(c, wbuf-\u003elnum, buf + written,\n                          wbuf-\u003eoffs, n);\n    // n \u003e len, read out of bounds less than 8(n-len) bytes\n  }\n\n, which can be catched by KASAN:\n  =========================================================\n  BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0\n  Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128\n  Workqueue: writeback wb_workfn (flush-ubifs_0_0)\n  Call Trace:\n    kasan_report.cold+0x81/0x165\n    nand_write_page_swecc+0xa9/0x160\n    ubifs_leb_write+0xf2/0x1b0 [ubifs]\n    ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs]\n    write_head+0xdc/0x1c0 [ubifs]\n    ubifs_jnl_write_inode+0x627/0x960 [ubifs]\n    wb_workfn+0x8af/0xb80\n\nFunction ubifs_wbuf_write_nolock() accepts that parameter \u0027len\u0027 is not 8\nbytes aligned, the \u0027len\u0027 represents the true length of buf (which is\nallocated in \u0027ubifs_jnl_xxx\u0027, eg. ubifs_jnl_write_inode), so\nubifs_wbuf_write_nolock() must handle the length read from \u0027buf\u0027 carefully\nto write leb safely.\n\nFetch a reproducer in [Link]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in UBIFS local journal writeback (ubifs_wbuf_write_nolock), reached via VFS operations such as creating a long symlink and forcing inode writeback on an already-mounted flash filesystem; it is not in a network-facing protocol stack.\nAC:L - A public reproducer reliably triggers the path by filling the journal write-buffer (deep mkdir tree), creating a non-8-byte-aligned symlink, and waiting for writeback\u2014all conditions the attacker controls.\nPR:L - On typical UBIFS deployments (embedded/Android system or data volumes already mounted), an unprivileged user with write permission can create symlinks/directories and dirty inodes to reach the vulnerable writeback path without needing CAP_SYS_ADMIN.\nUI:N - No victim action is required once UBIFS is mounted as system storage; the attacker alone performs the filesystem operations that dirty the inode and trigger writeback.\nS:U - Impact is confined to the local kernel/OS security authority (heap disclosure and possible oops); there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - The bug is a slab out-of-bounds read of adjacent kernel heap that is then written to flash via ubifs_leb_write, so leaked kernel memory can be exposed; choosing the higher severity for this memory disclosure.\nI:N - This is a read-only out-of-bounds access with no attacker-controlled write primitive, type confusion, or other integrity corruption of kernel state.\nA:H - Reading past a kmalloc object can fault into unmapped/adjacent memory and cause a kernel oops, and the KASAN report confirms a hard out-of-bounds access on the writeback path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:42.752Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5343575aa11c5d7044107d59d43f84aec01312b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b80ccbec0e4804436c382d7dd60e943c386ed83a"
        },
        {
          "url": "https://git.kernel.org/stable/c/07a209fadee7b53b46858538e1177597273862e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7054aaf1909cf40489c0ec1b728fdcf79c751a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e09fa5318d51f522e1af4fbaf8f74999355980c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b7fb89135a20587d57f8877c02e25003e9edbdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f2262a334641e05f645364d5ade1f565c85f20b"
        }
      ],
      "title": "ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47636",
    "datePublished": "2025-02-26T01:54:10.206Z",
    "dateReserved": "2025-02-26T01:48:21.519Z",
    "dateUpdated": "2026-08-05T08:48:42.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47636",
      "date": "2026-09-18",
      "epss": "0.00249",
      "percentile": "0.16534"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ubifs/io.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5343575aa11c5d7044107d59d43f84aec01312b0",
                    "status": "affected",
                    "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b80ccbec0e4804436c382d7dd60e943c386ed83a",
                    "status": "affected",
                    "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "07a209fadee7b53b46858538e1177597273862e4",
                    "status": "affected",
                    "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a7054aaf1909cf40489c0ec1b728fdcf79c751a6",
                    "status": "affected",
                    "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e09fa5318d51f522e1af4fbaf8f74999355980c8",
                    "status": "affected",
                    "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b7fb89135a20587d57f8877c02e25003e9edbdf",
                    "status": "affected",
                    "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f2262a334641e05f645364d5ade1f565c85f20b",
                    "status": "affected",
                    "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ubifs/io.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.27"
                  },
                  {
                    "lessThan": "2.6.27",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.238",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.16.*",
                    "status": "unaffected",
                    "version": "5.16.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.17.*",
                    "status": "unaffected",
                    "version": "5.17.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EF5DCB1F-AE17-4717-80C7-5786A2F74C0C",
                    "versionEndExcluding": "4.19.238",
                    "versionStartIncluding": "2.6.27",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8CB6E8F5-C2B1-46F3-A807-0F6104AC340F",
                    "versionEndExcluding": "5.4.189",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "91D3BFD0-D3F3-4018-957C-96CCBF357D79",
                    "versionEndExcluding": "5.10.110",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "27C42AE8-B387-43E2-938A-E1C8B40BE6D5",
                    "versionEndExcluding": "5.15.33",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "20C43679-0439-405A-B97F-685BEE50613B",
                    "versionEndExcluding": "5.16.19",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "210C679C-CF84-44A3-8939-E629C87E54BF",
                    "versionEndExcluding": "5.17.2",
                    "versionStartIncluding": "5.17",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()\n\nFunction ubifs_wbuf_write_nolock() may access buf out of bounds in\nfollowing process:\n\nubifs_wbuf_write_nolock():\n  aligned_len = ALIGN(len, 8);   // Assume len = 4089, aligned_len = 4096\n  if (aligned_len \u003c= wbuf-\u003eavail) ... // Not satisfy\n  if (wbuf-\u003eused) {\n    ubifs_leb_write()  // Fill some data in avail wbuf\n    len -= wbuf-\u003eavail;   // len is still not 8-bytes aligned\n    aligned_len -= wbuf-\u003eavail;\n  }\n  n = aligned_len \u003e\u003e c-\u003emax_write_shift;\n  if (n) {\n    n \u003c\u003c= c-\u003emax_write_shift;\n    err = ubifs_leb_write(c, wbuf-\u003elnum, buf + written,\n                          wbuf-\u003eoffs, n);\n    // n \u003e len, read out of bounds less than 8(n-len) bytes\n  }\n\n, which can be catched by KASAN:\n  =========================================================\n  BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0\n  Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128\n  Workqueue: writeback wb_workfn (flush-ubifs_0_0)\n  Call Trace:\n    kasan_report.cold+0x81/0x165\n    nand_write_page_swecc+0xa9/0x160\n    ubifs_leb_write+0xf2/0x1b0 [ubifs]\n    ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs]\n    write_head+0xdc/0x1c0 [ubifs]\n    ubifs_jnl_write_inode+0x627/0x960 [ubifs]\n    wb_workfn+0x8af/0xb80\n\nFunction ubifs_wbuf_write_nolock() accepts that parameter \u0027len\u0027 is not 8\nbytes aligned, the \u0027len\u0027 represents the true length of buf (which is\nallocated in \u0027ubifs_jnl_xxx\u0027, eg. ubifs_jnl_write_inode), so\nubifs_wbuf_write_nolock() must handle the length read from \u0027buf\u0027 carefully\nto write leb safely.\n\nFetch a reproducer in [Link]."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ubifs: Se corrige la lectura fuera de los l\u00edmites en la funci\u00f3n ubifs_wbuf_write_nolock() ubifs_wbuf_write_nolock() puede acceder a buf fuera de los l\u00edmites en el siguiente proceso: ubifs_wbuf_write_nolock(): classified_len = ALIGN(len, 8); // Supongamos que len = 4089, classified_len = 4096 if (aligned_len \u0026lt;= wbuf-\u0026gt;avail) ... // No satisface if (wbuf-\u0026gt;used) { ubifs_leb_write() // Complete algunos datos en avail wbuf len -= wbuf-\u0026gt;avail; // len a\u00fan no est\u00e1 alineado a 8 bytes classified_len -= wbuf-\u0026gt;avail; } n = classified_len \u0026gt;\u0026gt; c-\u0026gt;max_write_shift; if (n) { n \u0026lt;\u0026lt;= c-\u0026gt;max_write_shift; err = ubifs_leb_write(c, wbuf-\u0026gt;lnum, buf + escrito, wbuf-\u0026gt;offs, n); // n \u0026gt; len, lectura fuera de los l\u00edmites menor a 8(n-len) bytes }, lo cual puede ser detectado por KASAN: =========================================================== ERROR: KASAN: slab fuera de los l\u00edmites en ecc_sw_hamming_calculate+0x1dc/0x7d0 Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff888105594ff8 por la tarea kworker/u8:4/128 Cola de trabajo: escritura diferida wb_workfn (flush-ubifs_0_0) Rastreo de llamadas: kasan_report.cold+0x81/0x165 nand_write_page_swecc+0xa9/0x160 ubifs_leb_write+0xf2/0x1b0 [ubifs] ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs] write_head+0xdc/0x1c0 [ubifs] ubifs_jnl_write_inode+0x627/0x960 [ubifs] wb_workfn+0x8af/0xb80 La funci\u00f3n ubifs_wbuf_write_nolock() acepta que el par\u00e1metro \u0027len\u0027 no est\u00e9 alineado con 8 bytes, \u0027len\u0027 representa la longitud verdadera de buf (que est\u00e1 asignada en \u0027ubifs_jnl_xxx\u0027, p. ej. ubifs_jnl_write_inode), por lo que ubifs_wbuf_write_nolock() debe manejar la longitud le\u00edda de \u0027buf\u0027 con cuidado para escribir leb de forma segura. Obtenga un reproductor en [Enlace]."
          }
        ],
        "id": "CVE-2021-47636",
        "lastModified": "2026-06-17T04:18:12.480",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47636",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:50:54.449259Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-26T06:37:05.377",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/07a209fadee7b53b46858538e1177597273862e4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3b7fb89135a20587d57f8877c02e25003e9edbdf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4f2262a334641e05f645364d5ade1f565c85f20b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5343575aa11c5d7044107d59d43f84aec01312b0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a7054aaf1909cf40489c0ec1b728fdcf79c751a6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b80ccbec0e4804436c382d7dd60e943c386ed83a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e09fa5318d51f522e1af4fbaf8f74999355980c8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T22:44:46+00:00",
      "cve": "CVE-2021-47636",
      "id": "CVE-2021-47636",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47636.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-13T00:01:22Z",
      "cve": "CVE-2021-47636",
      "id": "CVE-2021-47636",
      "initial_release_date": "2025-02-27T03:14:26Z",
      "product_status:known_affected": "383",
      "product_status:known_not_affected": "352",
      "product_status:recommended": "223",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47636",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47636.json",
      "version": "39"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.1,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47636",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T19:50:54.449259Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-125",
                    "description": "CWE-125 Out-of-bounds Read",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T16:01:21.393Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/ubifs/io.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "5343575aa11c5d7044107d59d43f84aec01312b0",
                  "status": "affected",
                  "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                  "versionType": "git"
                },
                {
                  "lessThan": "b80ccbec0e4804436c382d7dd60e943c386ed83a",
                  "status": "affected",
                  "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                  "versionType": "git"
                },
                {
                  "lessThan": "07a209fadee7b53b46858538e1177597273862e4",
                  "status": "affected",
                  "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                  "versionType": "git"
                },
                {
                  "lessThan": "a7054aaf1909cf40489c0ec1b728fdcf79c751a6",
                  "status": "affected",
                  "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                  "versionType": "git"
                },
                {
                  "lessThan": "e09fa5318d51f522e1af4fbaf8f74999355980c8",
                  "status": "affected",
                  "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                  "versionType": "git"
                },
                {
                  "lessThan": "3b7fb89135a20587d57f8877c02e25003e9edbdf",
                  "status": "affected",
                  "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                  "versionType": "git"
                },
                {
                  "lessThan": "4f2262a334641e05f645364d5ade1f565c85f20b",
                  "status": "affected",
                  "version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/ubifs/io.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.27"
                },
                {
                  "lessThan": "2.6.27",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.238",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.189",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.110",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.33",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.16.*",
                  "status": "unaffected",
                  "version": "5.16.19",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.17.*",
                  "status": "unaffected",
                  "version": "5.17.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.18",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.238",
                      "versionStartIncluding": "2.6.27",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.189",
                      "versionStartIncluding": "2.6.27",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.110",
                      "versionStartIncluding": "2.6.27",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.33",
                      "versionStartIncluding": "2.6.27",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.16.19",
                      "versionStartIncluding": "2.6.27",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.17.2",
                      "versionStartIncluding": "2.6.27",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.18",
                      "versionStartIncluding": "2.6.27",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()\n\nFunction ubifs_wbuf_write_nolock() may access buf out of bounds in\nfollowing process:\n\nubifs_wbuf_write_nolock():\n  aligned_len = ALIGN(len, 8);   // Assume len = 4089, aligned_len = 4096\n  if (aligned_len \u003c= wbuf-\u003eavail) ... // Not satisfy\n  if (wbuf-\u003eused) {\n    ubifs_leb_write()  // Fill some data in avail wbuf\n    len -= wbuf-\u003eavail;   // len is still not 8-bytes aligned\n    aligned_len -= wbuf-\u003eavail;\n  }\n  n = aligned_len \u003e\u003e c-\u003emax_write_shift;\n  if (n) {\n    n \u003c\u003c= c-\u003emax_write_shift;\n    err = ubifs_leb_write(c, wbuf-\u003elnum, buf + written,\n                          wbuf-\u003eoffs, n);\n    // n \u003e len, read out of bounds less than 8(n-len) bytes\n  }\n\n, which can be catched by KASAN:\n  =========================================================\n  BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0\n  Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128\n  Workqueue: writeback wb_workfn (flush-ubifs_0_0)\n  Call Trace:\n    kasan_report.cold+0x81/0x165\n    nand_write_page_swecc+0xa9/0x160\n    ubifs_leb_write+0xf2/0x1b0 [ubifs]\n    ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs]\n    write_head+0xdc/0x1c0 [ubifs]\n    ubifs_jnl_write_inode+0x627/0x960 [ubifs]\n    wb_workfn+0x8af/0xb80\n\nFunction ubifs_wbuf_write_nolock() accepts that parameter \u0027len\u0027 is not 8\nbytes aligned, the \u0027len\u0027 represents the true length of buf (which is\nallocated in \u0027ubifs_jnl_xxx\u0027, eg. ubifs_jnl_write_inode), so\nubifs_wbuf_write_nolock() must handle the length read from \u0027buf\u0027 carefully\nto write leb safely.\n\nFetch a reproducer in [Link]."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is in UBIFS local journal writeback (ubifs_wbuf_write_nolock), reached via VFS operations such as creating a long symlink and forcing inode writeback on an already-mounted flash filesystem; it is not in a network-facing protocol stack.\nAC:L - A public reproducer reliably triggers the path by filling the journal write-buffer (deep mkdir tree), creating a non-8-byte-aligned symlink, and waiting for writeback\u2014all conditions the attacker controls.\nPR:L - On typical UBIFS deployments (embedded/Android system or data volumes already mounted), an unprivileged user with write permission can create symlinks/directories and dirty inodes to reach the vulnerable writeback path without needing CAP_SYS_ADMIN.\nUI:N - No victim action is required once UBIFS is mounted as system storage; the attacker alone performs the filesystem operations that dirty the inode and trigger writeback.\nS:U - Impact is confined to the local kernel/OS security authority (heap disclosure and possible oops); there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - The bug is a slab out-of-bounds read of adjacent kernel heap that is then written to flash via ubifs_leb_write, so leaked kernel memory can be exposed; choosing the higher severity for this memory disclosure.\nI:N - This is a read-only out-of-bounds access with no attacker-controlled write primitive, type confusion, or other integrity corruption of kernel state.\nA:H - Reading past a kmalloc object can fault into unmapped/adjacent memory and cause a kernel oops, and the KASAN report confirms a hard out-of-bounds access on the writeback path."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:48:42.752Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/5343575aa11c5d7044107d59d43f84aec01312b0"
            },
            {
              "url": "https://git.kernel.org/stable/c/b80ccbec0e4804436c382d7dd60e943c386ed83a"
            },
            {
              "url": "https://git.kernel.org/stable/c/07a209fadee7b53b46858538e1177597273862e4"
            },
            {
              "url": "https://git.kernel.org/stable/c/a7054aaf1909cf40489c0ec1b728fdcf79c751a6"
            },
            {
              "url": "https://git.kernel.org/stable/c/e09fa5318d51f522e1af4fbaf8f74999355980c8"
            },
            {
              "url": "https://git.kernel.org/stable/c/3b7fb89135a20587d57f8877c02e25003e9edbdf"
            },
            {
              "url": "https://git.kernel.org/stable/c/4f2262a334641e05f645364d5ade1f565c85f20b"
            }
          ],
          "title": "ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47636",
        "datePublished": "2025-02-26T01:54:10.206Z",
        "dateReserved": "2025-02-26T01:48:21.519Z",
        "dateUpdated": "2026-08-05T08:48:42.752Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.