{
  "cveId": "CVE-2021-47191",
  "url": "https://patchblox.com/security/cve/CVE-2021-47191",
  "summary": "CVE-2021-47191 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47191, released April 10, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: scsi_debug: Fix out-of-bound read in resp_...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()  The following warning was observed running syzkaller:  [ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724]    program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer\u002B0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995]  dump_stack\u002B0x108/0x15f [ 3813.847524]  print_address_description\u002B0xa5/0x372 [ 3813.848243]  kasan_report.cold\u002B0x236/0x2a8 [ 3813.849439]  check_memory_region\u002B0x240/0x270 [ 3813.850094]  memcpy\u002B0x30/0x80 [ 3813.850553]  sg_copy_buffer\u002B0x157/0x1e0 [ 3813.853032]  sg_copy_from_buffer\u002B0x13/0x20 [ 3813.853660]  fill_from_dev_buffer\u002B0x135/0x370 [ 3813.854329]  resp_readcap16\u002B0x1ac/0x280 [ 3813.856917]  schedule_resp\u002B0x41f/0x1630 [ 3813.858203]  scsi_debug_queuecommand\u002B0xb32/0x17e0 [ 3813.862699]  scsi_dispatch_cmd\u002B0x330/0x950 [ 3813.863329]  scsi_request_fn\u002B0xd8e/0x1710 [ 3813.863946]  __blk_run_queue\u002B0x10b/0x230 [ 3813.864544]  blk_execute_rq_nowait\u002B0x1d8/0x400 [ 3813.865220]  sg_common_write.isra.0\u002B0xe61/0x2420 [ 3813.871637]  sg_write\u002B0x6c8/0xef0 [ 3813.878853]  __vfs_write\u002B0xe4/0x800 [ 3813.883487]  vfs_write\u002B0x17b/0x530 [ 3813.884008]  ksys_write\u002B0x103/0x270 [ 3813.886268]  __x64_sys_write\u002B0x77/0xc0 [ 3813.886841]  do_syscall_64\u002B0x106/0x360 [ 3813.887415]  entry_SYSCALL_64_after_hwframe\u002B0x44/0xa9  This issue can be reproduced with the following syzkaller log:  r0 = openat(0xffffffffffffff9c, \u0026(0x7f0000000040)=\u0027./file0\\x00\u0027, 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, \u0026(0x7f0000000000)=\u0027fd/3\\x00\u0027) open_by_handle_at(r1, \u0026(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(\u0026(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, \u0026(0x7f0000000340)=ANY=[@ANYBLOB=\u002200000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d\u0022], 0x126)  In resp_readcap16() we get \u0022int alloc_len\u0022 value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This leads to OOB in sg_copy_buffer().  To solve this issue, define alloc_len as u32.",
  "published": "2024-04-10T19:15:47Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00238,
  "epssPercentile": 0.14925,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.15.5-1",
      "fix": "DEBIAN-CVE-2021-47191",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47191",
      "released": "2024-04-10T19:15:47Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.15.5-1",
      "fix": "DEBIAN-CVE-2021-47191",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47191",
      "released": "2024-04-10T19:15:47Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.15.5-1",
      "fix": "DEBIAN-CVE-2021-47191",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47191",
      "released": "2024-04-10T19:15:47Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}