{
  "cveId": "CVE-2021-47288",
  "url": "https://patchblox.com/security/cve/CVE-2021-47288",
  "summary": "CVE-2021-47288 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47288, released May 21, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  media: ngene: Fix out-of-bounds bug in ngene_com...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()  Fix an 11-year old bug in ngene_command_config_free_buf() while addressing the following warnings caught with -Warray-bounds:  arch/alpha/include/asm/string.h:22:16: warning: \u0027__builtin_memcpy\u0027 offset [12, 16] from the object at \u0027com\u0027 is out of the bounds of referenced subobject \u0027config\u0027 with type \u0027unsigned char\u0027 at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: \u0027__builtin_memcpy\u0027 offset [12, 16] from the object at \u0027com\u0027 is out of the bounds of referenced subobject \u0027config\u0027 with type \u0027unsigned char\u0027 at offset 10 [-Warray-bounds]  The problem is that the original code is trying to copy 6 bytes of data into a one-byte size member _config_ of the wrong structue FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of \u0026com.cmd.ConfigureBuffers.config. It seems that the right structure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header _hdr_. Also, the name of the function ngene_command_config_free_buf() suggests that the actual intention is to ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function ngene_command_config_buf(), above).  Fix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS into new struct config, and use \u0026com.cmd.ConfigureFreeBuffers.config as the destination address, instead of \u0026com.cmd.ConfigureBuffers.config, when calling memcpy().  This also helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().",
  "published": "2024-05-21T15:15:16Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00234,
  "epssPercentile": 0.14423,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.14.6-1",
      "fix": "DEBIAN-CVE-2021-47288",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47288",
      "released": "2024-05-21T15:15:16Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.14.6-1",
      "fix": "DEBIAN-CVE-2021-47288",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47288",
      "released": "2024-05-21T15:15:16Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.14.6-1",
      "fix": "DEBIAN-CVE-2021-47288",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47288",
      "released": "2024-05-21T15:15:16Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}