GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47288 (GCVE-0-2021-47288)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:34 – Updated: 2026-05-11 13:51
VLAI
Title
media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
Summary
In the Linux kernel, the following vulnerability has been resolved: media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() Fix an 11-year old bug in ngene_command_config_free_buf() while addressing the following warnings caught with -Warray-bounds: arch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] The problem is that the original code is trying to copy 6 bytes of data into a one-byte size member _config_ of the wrong structue FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. It seems that the right structure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header _hdr_. Also, the name of the function ngene_command_config_free_buf() suggests that the actual intention is to ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function ngene_command_config_buf(), above). Fix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as the destination address, instead of &com.cmd.ConfigureBuffers.config, when calling memcpy(). This also helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-21 18:48 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: dae52d009fc950b5c209260d50fcc000f5becd3c , < 4487b968e5eacd02c493303dc2b61150bb7fe4b2 (git)
Affected: dae52d009fc950b5c209260d50fcc000f5becd3c , < c6ddeb63dd543b5474b0217c4e47538b7ffd7686 (git)
Affected: dae52d009fc950b5c209260d50fcc000f5becd3c , < e818f2ff648581a6c553ae2bebc5dcef9a8bb90c (git)
Affected: dae52d009fc950b5c209260d50fcc000f5becd3c , < ec731c6ef564ee6fc101fc5d73e3a3a953d09a00 (git)
Affected: dae52d009fc950b5c209260d50fcc000f5becd3c , < e617fa62f6cf859a7b042cdd6c73af905ff8fca3 (git)
Affected: dae52d009fc950b5c209260d50fcc000f5becd3c , < e991457afdcb5f4dbc5bc9d79eaf775be33e7092 (git)
Affected: dae52d009fc950b5c209260d50fcc000f5becd3c , < b9a178f189bb6d75293573e181928735f5e3e070 (git)
Affected: dae52d009fc950b5c209260d50fcc000f5becd3c , < 8d4abca95ecc82fc8c41912fa0085281f19cc29f (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 4.4.277 , ≤ 4.4.* (semver)
Unaffected: 4.9.277 , ≤ 4.9.* (semver)
Unaffected: 4.14.241 , ≤ 4.14.* (semver)
Unaffected: 4.19.199 , ≤ 4.19.* (semver)
Unaffected: 5.4.136 , ≤ 5.4.* (semver)
Unaffected: 5.10.54 , ≤ 5.10.* (semver)
Unaffected: 5.13.6 , ≤ 5.13.* (semver)
Unaffected: 5.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47288",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T18:48:38.044089Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:21.595Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4487b968e5eacd02c493303dc2b61150bb7fe4b2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c6ddeb63dd543b5474b0217c4e47538b7ffd7686"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e818f2ff648581a6c553ae2bebc5dcef9a8bb90c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec731c6ef564ee6fc101fc5d73e3a3a953d09a00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e617fa62f6cf859a7b042cdd6c73af905ff8fca3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e991457afdcb5f4dbc5bc9d79eaf775be33e7092"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b9a178f189bb6d75293573e181928735f5e3e070"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8d4abca95ecc82fc8c41912fa0085281f19cc29f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/ngene/ngene-core.c",
            "drivers/media/pci/ngene/ngene.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4487b968e5eacd02c493303dc2b61150bb7fe4b2",
              "status": "affected",
              "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
              "versionType": "git"
            },
            {
              "lessThan": "c6ddeb63dd543b5474b0217c4e47538b7ffd7686",
              "status": "affected",
              "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
              "versionType": "git"
            },
            {
              "lessThan": "e818f2ff648581a6c553ae2bebc5dcef9a8bb90c",
              "status": "affected",
              "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
              "versionType": "git"
            },
            {
              "lessThan": "ec731c6ef564ee6fc101fc5d73e3a3a953d09a00",
              "status": "affected",
              "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
              "versionType": "git"
            },
            {
              "lessThan": "e617fa62f6cf859a7b042cdd6c73af905ff8fca3",
              "status": "affected",
              "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
              "versionType": "git"
            },
            {
              "lessThan": "e991457afdcb5f4dbc5bc9d79eaf775be33e7092",
              "status": "affected",
              "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
              "versionType": "git"
            },
            {
              "lessThan": "b9a178f189bb6d75293573e181928735f5e3e070",
              "status": "affected",
              "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
              "versionType": "git"
            },
            {
              "lessThan": "8d4abca95ecc82fc8c41912fa0085281f19cc29f",
              "status": "affected",
              "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/ngene/ngene-core.c",
            "drivers/media/pci/ngene/ngene.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.277",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.277",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.277",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.277",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.241",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.199",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.136",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.54",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.6",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()\n\nFix an 11-year old bug in ngene_command_config_free_buf() while\naddressing the following warnings caught with -Warray-bounds:\n\narch/alpha/include/asm/string.h:22:16: warning: \u0027__builtin_memcpy\u0027 offset [12, 16] from the object at \u0027com\u0027 is out of the bounds of referenced subobject \u0027config\u0027 with type \u0027unsigned char\u0027 at offset 10 [-Warray-bounds]\narch/x86/include/asm/string_32.h:182:25: warning: \u0027__builtin_memcpy\u0027 offset [12, 16] from the object at \u0027com\u0027 is out of the bounds of referenced subobject \u0027config\u0027 with type \u0027unsigned char\u0027 at offset 10 [-Warray-bounds]\n\nThe problem is that the original code is trying to copy 6 bytes of\ndata into a one-byte size member _config_ of the wrong structue\nFW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a\nlegitimate compiler warning because memcpy() overruns the length\nof \u0026com.cmd.ConfigureBuffers.config. It seems that the right\nstructure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains\n6 more members apart from the header _hdr_. Also, the name of\nthe function ngene_command_config_free_buf() suggests that the actual\nintention is to ConfigureFreeBuffers, instead of ConfigureBuffers\n(which takes place in the function ngene_command_config_buf(), above).\n\nFix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS\ninto new struct config, and use \u0026com.cmd.ConfigureFreeBuffers.config as\nthe destination address, instead of \u0026com.cmd.ConfigureBuffers.config,\nwhen calling memcpy().\n\nThis also helps with the ongoing efforts to globally enable\n-Warray-bounds and get us closer to being able to tighten the\nFORTIFY_SOURCE routines on memcpy()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:51:35.497Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4487b968e5eacd02c493303dc2b61150bb7fe4b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6ddeb63dd543b5474b0217c4e47538b7ffd7686"
        },
        {
          "url": "https://git.kernel.org/stable/c/e818f2ff648581a6c553ae2bebc5dcef9a8bb90c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec731c6ef564ee6fc101fc5d73e3a3a953d09a00"
        },
        {
          "url": "https://git.kernel.org/stable/c/e617fa62f6cf859a7b042cdd6c73af905ff8fca3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e991457afdcb5f4dbc5bc9d79eaf775be33e7092"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9a178f189bb6d75293573e181928735f5e3e070"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d4abca95ecc82fc8c41912fa0085281f19cc29f"
        }
      ],
      "title": "media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47288",
    "datePublished": "2024-05-21T14:34:51.776Z",
    "dateReserved": "2024-05-21T13:27:52.129Z",
    "dateUpdated": "2026-05-11T13:51:35.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47288",
      "date": "2026-09-18",
      "epss": "0.00234",
      "percentile": "0.1469"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/pci/ngene/ngene-core.c",
                  "drivers/media/pci/ngene/ngene.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4487b968e5eacd02c493303dc2b61150bb7fe4b2",
                    "status": "affected",
                    "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c6ddeb63dd543b5474b0217c4e47538b7ffd7686",
                    "status": "affected",
                    "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e818f2ff648581a6c553ae2bebc5dcef9a8bb90c",
                    "status": "affected",
                    "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ec731c6ef564ee6fc101fc5d73e3a3a953d09a00",
                    "status": "affected",
                    "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e617fa62f6cf859a7b042cdd6c73af905ff8fca3",
                    "status": "affected",
                    "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e991457afdcb5f4dbc5bc9d79eaf775be33e7092",
                    "status": "affected",
                    "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b9a178f189bb6d75293573e181928735f5e3e070",
                    "status": "affected",
                    "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8d4abca95ecc82fc8c41912fa0085281f19cc29f",
                    "status": "affected",
                    "version": "dae52d009fc950b5c209260d50fcc000f5becd3c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/pci/ngene/ngene-core.c",
                  "drivers/media/pci/ngene/ngene.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.34"
                  },
                  {
                    "lessThan": "2.6.34",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.4.*",
                    "status": "unaffected",
                    "version": "4.4.277",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.277",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.241",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.199",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.13.*",
                    "status": "unaffected",
                    "version": "5.13.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7D45A9E6-B9E0-4304-BC21-EA9A34A2DB7C",
                    "versionEndExcluding": "4.4.277",
                    "versionStartIncluding": "2.6.34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B543C082-5612-489A-A957-B7F2B8822025",
                    "versionEndExcluding": "4.9.277",
                    "versionStartIncluding": "4.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A796929-CDBE-45AF-BD44-F357F64AFFCA",
                    "versionEndExcluding": "4.14.241",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D1C5B0E1-06E7-4615-AA17-02585202D86E",
                    "versionEndExcluding": "4.19.199",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E1FCD98C-8886-4844-B7AF-C42731DF9465",
                    "versionEndExcluding": "5.4.136",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1BD5A2EE-859F-40FC-BDAC-167AAE37C870",
                    "versionEndExcluding": "5.10.54",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "512C22FC-1524-4E6F-9E62-4F4B7B6E0576",
                    "versionEndExcluding": "5.13.6",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "71268287-21A8-4488-AA4F-23C473153131",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "23B9E5C6-FAB5-4A02-9E39-27C8787B0991",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()\n\nFix an 11-year old bug in ngene_command_config_free_buf() while\naddressing the following warnings caught with -Warray-bounds:\n\narch/alpha/include/asm/string.h:22:16: warning: \u0027__builtin_memcpy\u0027 offset [12, 16] from the object at \u0027com\u0027 is out of the bounds of referenced subobject \u0027config\u0027 with type \u0027unsigned char\u0027 at offset 10 [-Warray-bounds]\narch/x86/include/asm/string_32.h:182:25: warning: \u0027__builtin_memcpy\u0027 offset [12, 16] from the object at \u0027com\u0027 is out of the bounds of referenced subobject \u0027config\u0027 with type \u0027unsigned char\u0027 at offset 10 [-Warray-bounds]\n\nThe problem is that the original code is trying to copy 6 bytes of\ndata into a one-byte size member _config_ of the wrong structue\nFW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a\nlegitimate compiler warning because memcpy() overruns the length\nof \u0026com.cmd.ConfigureBuffers.config. It seems that the right\nstructure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains\n6 more members apart from the header _hdr_. Also, the name of\nthe function ngene_command_config_free_buf() suggests that the actual\nintention is to ConfigureFreeBuffers, instead of ConfigureBuffers\n(which takes place in the function ngene_command_config_buf(), above).\n\nFix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS\ninto new struct config, and use \u0026com.cmd.ConfigureFreeBuffers.config as\nthe destination address, instead of \u0026com.cmd.ConfigureBuffers.config,\nwhen calling memcpy().\n\nThis also helps with the ongoing efforts to globally enable\n-Warray-bounds and get us closer to being able to tighten the\nFORTIFY_SOURCE routines on memcpy()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: medios: ngene: corrige un error fuera de los l\u00edmites en ngene_command_config_free_buf(). Corrige un error de hace 11 a\u00f1os en ngene_command_config_free_buf() mientras se solucionan las siguientes advertencias detectadas con -Warray-bounds: arch/alpha/include/asm/string.h:22:16: advertencia: el desplazamiento \u0027__builtin_memcpy\u0027 [12, 16] del objeto en \u0027com\u0027 est\u00e1 fuera de los l\u00edmites del subobjeto referenciado \u0027config\u0027 con tipo \u0027car\u00e1cter sin firmar \u0027 en el desplazamiento 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: advertencia: el desplazamiento \u0027__builtin_memcpy\u0027 [12, 16] del objeto en \u0027com\u0027 est\u00e1 fuera de los l\u00edmites de subobjeto referenciado \u0027config\u0027 con tipo \u0027unsigned char\u0027 en el desplazamiento 10 [-Warray-bounds] El problema es que el c\u00f3digo original est\u00e1 intentando copiar 6 bytes de datos en un miembro de tama\u00f1o de un byte _config_ de la estructura incorrecta FW_CONFIGURE_BUFFERS, en una sola llamada a memcpy(). Esto provoca una advertencia leg\u00edtima del compilador porque memcpy() sobrepasa la longitud de \u0026amp;com.cmd.ConfigureBuffers.config. Parece que la estructura correcta es FW_CONFIGURE_FREE_BUFFERS, porque contiene 6 miembros m\u00e1s adem\u00e1s del encabezado _hdr_. Adem\u00e1s, el nombre de la funci\u00f3n ngene_command_config_free_buf() sugiere que la intenci\u00f3n real es ConfigureFreeBuffers, en lugar de ConfigureBuffers (que tiene lugar en la funci\u00f3n ngene_command_config_buf(), arriba). Solucione este problema encerrando esos 6 miembros de la estructura FW_CONFIGURE_FREE_BUFFERS en una nueva configuraci\u00f3n de estructura y use \u0026amp;com.cmd.ConfigureFreeBuffers.config como direcci\u00f3n de destino, en lugar de \u0026amp;com.cmd.ConfigureBuffers.config, al llamar a memcpy(). Esto tambi\u00e9n ayuda con los esfuerzos continuos para habilitar globalmente -Warray-bounds y acercarnos a poder ajustar las rutinas FORTIFY_SOURCE en memcpy()."
          }
        ],
        "id": "CVE-2021-47288",
        "lastModified": "2026-06-17T04:17:06.677",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47288",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T18:48:38.044089Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-21T15:15:16.867",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4487b968e5eacd02c493303dc2b61150bb7fe4b2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8d4abca95ecc82fc8c41912fa0085281f19cc29f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b9a178f189bb6d75293573e181928735f5e3e070"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c6ddeb63dd543b5474b0217c4e47538b7ffd7686"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e617fa62f6cf859a7b042cdd6c73af905ff8fca3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e818f2ff648581a6c553ae2bebc5dcef9a8bb90c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e991457afdcb5f4dbc5bc9d79eaf775be33e7092"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ec731c6ef564ee6fc101fc5d73e3a3a953d09a00"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4487b968e5eacd02c493303dc2b61150bb7fe4b2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8d4abca95ecc82fc8c41912fa0085281f19cc29f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b9a178f189bb6d75293573e181928735f5e3e070"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c6ddeb63dd543b5474b0217c4e47538b7ffd7686"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e617fa62f6cf859a7b042cdd6c73af905ff8fca3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e818f2ff648581a6c553ae2bebc5dcef9a8bb90c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e991457afdcb5f4dbc5bc9d79eaf775be33e7092"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ec731c6ef564ee6fc101fc5d73e3a3a953d09a00"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:11:56+00:00",
      "cve": "CVE-2021-47288",
      "id": "CVE-2021-47288",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47288.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:32:08.191Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4487b968e5eacd02c493303dc2b61150bb7fe4b2"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/c6ddeb63dd543b5474b0217c4e47538b7ffd7686"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/e818f2ff648581a6c553ae2bebc5dcef9a8bb90c"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ec731c6ef564ee6fc101fc5d73e3a3a953d09a00"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/e617fa62f6cf859a7b042cdd6c73af905ff8fca3"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/e991457afdcb5f4dbc5bc9d79eaf775be33e7092"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/b9a178f189bb6d75293573e181928735f5e3e070"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8d4abca95ecc82fc8c41912fa0085281f19cc29f"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47288",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-21T18:48:38.044089Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:25.492Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/media/pci/ngene/ngene-core.c",
                "drivers/media/pci/ngene/ngene.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "4487b968e5ea",
                  "status": "affected",
                  "version": "dae52d009fc9",
                  "versionType": "git"
                },
                {
                  "lessThan": "c6ddeb63dd54",
                  "status": "affected",
                  "version": "dae52d009fc9",
                  "versionType": "git"
                },
                {
                  "lessThan": "e818f2ff6485",
                  "status": "affected",
                  "version": "dae52d009fc9",
                  "versionType": "git"
                },
                {
                  "lessThan": "ec731c6ef564",
                  "status": "affected",
                  "version": "dae52d009fc9",
                  "versionType": "git"
                },
                {
                  "lessThan": "e617fa62f6cf",
                  "status": "affected",
                  "version": "dae52d009fc9",
                  "versionType": "git"
                },
                {
                  "lessThan": "e991457afdcb",
                  "status": "affected",
                  "version": "dae52d009fc9",
                  "versionType": "git"
                },
                {
                  "lessThan": "b9a178f189bb",
                  "status": "affected",
                  "version": "dae52d009fc9",
                  "versionType": "git"
                },
                {
                  "lessThan": "8d4abca95ecc",
                  "status": "affected",
                  "version": "dae52d009fc9",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/media/pci/ngene/ngene-core.c",
                "drivers/media/pci/ngene/ngene.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.34"
                },
                {
                  "lessThan": "2.6.34",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.4.*",
                  "status": "unaffected",
                  "version": "4.4.277",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.277",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.241",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.199",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.136",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.54",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "5.13.*",
                  "status": "unaffected",
                  "version": "5.13.6",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.14",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()\n\nFix an 11-year old bug in ngene_command_config_free_buf() while\naddressing the following warnings caught with -Warray-bounds:\n\narch/alpha/include/asm/string.h:22:16: warning: \u0027__builtin_memcpy\u0027 offset [12, 16] from the object at \u0027com\u0027 is out of the bounds of referenced subobject \u0027config\u0027 with type \u0027unsigned char\u0027 at offset 10 [-Warray-bounds]\narch/x86/include/asm/string_32.h:182:25: warning: \u0027__builtin_memcpy\u0027 offset [12, 16] from the object at \u0027com\u0027 is out of the bounds of referenced subobject \u0027config\u0027 with type \u0027unsigned char\u0027 at offset 10 [-Warray-bounds]\n\nThe problem is that the original code is trying to copy 6 bytes of\ndata into a one-byte size member _config_ of the wrong structue\nFW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a\nlegitimate compiler warning because memcpy() overruns the length\nof \u0026com.cmd.ConfigureBuffers.config. It seems that the right\nstructure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains\n6 more members apart from the header _hdr_. Also, the name of\nthe function ngene_command_config_free_buf() suggests that the actual\nintention is to ConfigureFreeBuffers, instead of ConfigureBuffers\n(which takes place in the function ngene_command_config_buf(), above).\n\nFix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS\ninto new struct config, and use \u0026com.cmd.ConfigureFreeBuffers.config as\nthe destination address, instead of \u0026com.cmd.ConfigureBuffers.config,\nwhen calling memcpy().\n\nThis also helps with the ongoing efforts to globally enable\n-Warray-bounds and get us closer to being able to tighten the\nFORTIFY_SOURCE routines on memcpy()."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-05-29T05:05:20.262Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/4487b968e5eacd02c493303dc2b61150bb7fe4b2"
            },
            {
              "url": "https://git.kernel.org/stable/c/c6ddeb63dd543b5474b0217c4e47538b7ffd7686"
            },
            {
              "url": "https://git.kernel.org/stable/c/e818f2ff648581a6c553ae2bebc5dcef9a8bb90c"
            },
            {
              "url": "https://git.kernel.org/stable/c/ec731c6ef564ee6fc101fc5d73e3a3a953d09a00"
            },
            {
              "url": "https://git.kernel.org/stable/c/e617fa62f6cf859a7b042cdd6c73af905ff8fca3"
            },
            {
              "url": "https://git.kernel.org/stable/c/e991457afdcb5f4dbc5bc9d79eaf775be33e7092"
            },
            {
              "url": "https://git.kernel.org/stable/c/b9a178f189bb6d75293573e181928735f5e3e070"
            },
            {
              "url": "https://git.kernel.org/stable/c/8d4abca95ecc82fc8c41912fa0085281f19cc29f"
            }
          ],
          "title": "media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()",
          "x_generator": {
            "engine": "bippy-a5840b7849dd"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47288",
        "datePublished": "2024-05-21T14:34:51.776Z",
        "dateReserved": "2024-05-21T13:27:52.129Z",
        "dateUpdated": "2024-08-04T05:32:08.191Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.