7.1

CVE-2021-47039

ataflop: potential out of bounds in do_format()

In the Linux kernel, the following vulnerability has been resolved:

ataflop: potential out of bounds in do_format()

The function uses "type" as an array index:

	q = unit[drive].disk[type]->queue;

Unfortunately the bounds check on "type" isn't done until later in the
function.  Fix this by moving the bounds check to the start.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.11 < 5.11.21
Linux ≫ Linux Kernel Version >= 5.12 < 5.12.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.153
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

https://git.kernel.org/stable/c/07f86aa8f4fe077be1b018cc177eb8c6573e5671
Patch
https://git.kernel.org/stable/c/1ffec389a6431782a8a28805830b6fae9bf00af1
Patch
https://git.kernel.org/stable/c/2a3a8bbca28b899806844c00d49ed1b7ccb50957
Patch