{
  "cveId": "CVE-2021-47636",
  "url": "https://patchblox.com/security/cve/CVE-2021-47636",
  "summary": "CVE-2021-47636 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47636, released February 26, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ubifs: Fix read out-of-bounds in ubifs_wbuf_writ...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()  Function ubifs_wbuf_write_nolock() may access buf out of bounds in following process:  ubifs_wbuf_write_nolock():   aligned_len = ALIGN(len, 8);   // Assume len = 4089, aligned_len = 4096   if (aligned_len \u003C= wbuf-\u003Eavail) ... // Not satisfy   if (wbuf-\u003Eused) {     ubifs_leb_write()  // Fill some data in avail wbuf     len -= wbuf-\u003Eavail;   // len is still not 8-bytes aligned     aligned_len -= wbuf-\u003Eavail;   }   n = aligned_len \u003E\u003E c-\u003Emax_write_shift;   if (n) {     n \u003C\u003C= c-\u003Emax_write_shift;     err = ubifs_leb_write(c, wbuf-\u003Elnum, buf \u002B written,                           wbuf-\u003Eoffs, n);     // n \u003E len, read out of bounds less than 8(n-len) bytes   }  , which can be catched by KASAN:   =========================================================   BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate\u002B0x1dc/0x7d0   Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128   Workqueue: writeback wb_workfn (flush-ubifs_0_0)   Call Trace:     kasan_report.cold\u002B0x81/0x165     nand_write_page_swecc\u002B0xa9/0x160     ubifs_leb_write\u002B0xf2/0x1b0 [ubifs]     ubifs_wbuf_write_nolock\u002B0x421/0x12c0 [ubifs]     write_head\u002B0xdc/0x1c0 [ubifs]     ubifs_jnl_write_inode\u002B0x627/0x960 [ubifs]     wb_workfn\u002B0x8af/0xb80  Function ubifs_wbuf_write_nolock() accepts that parameter \u0027len\u0027 is not 8 bytes aligned, the \u0027len\u0027 represents the true length of buf (which is allocated in \u0027ubifs_jnl_xxx\u0027, eg. ubifs_jnl_write_inode), so ubifs_wbuf_write_nolock() must handle the length read from \u0027buf\u0027 carefully to write leb safely.  Fetch a reproducer in [Link].",
  "published": "2025-02-26T06:37:05Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.0026,
  "epssPercentile": 0.17876,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.17.3-1",
      "fix": "DEBIAN-CVE-2021-47636",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47636",
      "released": "2025-02-26T06:37:05Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.17.3-1",
      "fix": "DEBIAN-CVE-2021-47636",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47636",
      "released": "2025-02-26T06:37:05Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.17.3-1",
      "fix": "DEBIAN-CVE-2021-47636",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47636",
      "released": "2025-02-26T06:37:05Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}