GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47083 (GCVE-0-2021-47083)

Vulnerability from cvelistv5 – Published: 2024-03-04 18:06 – Updated: 2026-08-05 08:45
VLAI
Title
pinctrl: mediatek: fix global-out-of-bounds issue
Summary
In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: fix global-out-of-bounds issue When eint virtual eint number is greater than gpio number, it maybe produce 'desc[eint_n]' size globle-out-of-bounds issue.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-04 19:54 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fb5fa8dc151b2364c975a9070eedb28a354a995a , < f373298e1bf0c6ea097c0bcc558dc43ad53e421f (git)
Affected: fb5fa8dc151b2364c975a9070eedb28a354a995a , < 441d3873664d170982922c5d2fc01fa89d9439ed (git)
Affected: fb5fa8dc151b2364c975a9070eedb28a354a995a , < fb563baa3eb8e7a15f2cff3c2695e2cca0493e69 (git)
Affected: fb5fa8dc151b2364c975a9070eedb28a354a995a , < 2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 5.4.169 , ≤ 5.4.* (semver)
Unaffected: 5.10.89 , ≤ 5.10.* (semver)
Unaffected: 5.15.12 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47083",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-04T19:54:49.113562Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:07.207Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.666Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fb563baa3eb8e7a15f2cff3c2695e2cca0493e69"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f373298e1bf0c6ea097c0bcc558dc43ad53e421f",
              "status": "affected",
              "version": "fb5fa8dc151b2364c975a9070eedb28a354a995a",
              "versionType": "git"
            },
            {
              "lessThan": "441d3873664d170982922c5d2fc01fa89d9439ed",
              "status": "affected",
              "version": "fb5fa8dc151b2364c975a9070eedb28a354a995a",
              "versionType": "git"
            },
            {
              "lessThan": "fb563baa3eb8e7a15f2cff3c2695e2cca0493e69",
              "status": "affected",
              "version": "fb5fa8dc151b2364c975a9070eedb28a354a995a",
              "versionType": "git"
            },
            {
              "lessThan": "2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d",
              "status": "affected",
              "version": "fb5fa8dc151b2364c975a9070eedb28a354a995a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.169",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.89",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.12",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: fix global-out-of-bounds issue\n\nWhen eint virtual eint number is greater than gpio number,\nit maybe produce \u0027desc[eint_n]\u0027 size globle-out-of-bounds issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The OOB is in MediaTek pinctrl EINT\u2192GPIO translation (`mtk_xt_get_gpio_n`), reached when a local caller requests an IRQ on a virtual GPIO (eint_n \u2265 npins) via `/dev/gpiochipN` line-event ioctls \u2192 `gpiod_to_irq` \u2192 `request_threaded_irq` \u2192 `mtk_eint_irq_request_resources`, not via network or physical plug-in paths.\nAC:L - On SoCs with virtual EINTs (e.g. mt8195 GPIO156\u2192eint 216 with npins=165), requesting edge detection on that line always indexes `desc[eint_n]` past the pin table; the attacker fully controls the trigger with no race or uncontrollable layout dependency.\nPR:L - The gpio chardev ioctl path has no capability check\u2014only DAC on `/dev/gpiochipN`, which on MediaTek phones, Chromebooks, IoT, and factory systems is commonly granted to non-root (gpio group/seat), matching prior gpiochip scoring (e.g. CVE-2022-48660); user-namespace root is not required.\nUI:N - The attacker opens the gpiochip device and issues the line-event/edge ioctl themselves; no separate victim action is required.\nS:U - Impact is confined to host-kernel memory safety within the same OS privilege domain; this is not a VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - The bug is a global out-of-bounds read of `desc[eint_n]` (and follow-on pin-desc fields on the false-match path); per kernel OOB-read guidance this is Confidentiality High.\nI:N - The defect itself is an OOB read with no OOB write; a false greedy match yields gpio_n \u2265 ngpio and fails `gpiochip_lock_as_irq` before `set_gpio_as_eint`/`mtk_hw_set_value`, so there is no write or control-flow integrity primitive.\nA:H - Global OOB access is a kernel memory-safety violation that KASAN/hardened builds treat as oops-class failures, and a false-match path can drive `mtk_hw_get_value` with garbage register indices producing further faults, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:54.954Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f"
        },
        {
          "url": "https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb563baa3eb8e7a15f2cff3c2695e2cca0493e69"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d"
        }
      ],
      "title": "pinctrl: mediatek: fix global-out-of-bounds issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47083",
    "datePublished": "2024-03-04T18:06:20.100Z",
    "dateReserved": "2024-02-29T22:33:44.298Z",
    "dateUpdated": "2026-08-05T08:45:54.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47083",
      "date": "2026-09-16",
      "epss": "0.00227",
      "percentile": "0.13592"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npinctrl: mediatek: fix global-out-of-bounds issue\\n\\nWhen eint virtual eint number is greater than gpio number,\\nit maybe produce \u0027desc[eint_n]\u0027 size globle-out-of-bounds issue.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: pinctrl: mediatek: soluciona el problema global fuera de los l\\u00edmites Cuando el n\\u00famero eint virtual eint es mayor que el n\\u00famero gpio, puede producir un tama\\u00f1o \u0027desc[eint_n]\u0027 globle-out- cuesti\\u00f3n de fuera de los l\\u00edmites.\"}]",
      "id": "CVE-2021-47083",
      "lastModified": "2024-11-21T06:35:22.000",
      "published": "2024-03-04T18:15:07.193",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/fb563baa3eb8e7a15f2cff3c2695e2cca0493e69\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/fb563baa3eb8e7a15f2cff3c2695e2cca0493e69\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Undergoing Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47083\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-04T18:15:07.193\",\"lastModified\":\"2026-08-04T10:16:44.833\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npinctrl: mediatek: fix global-out-of-bounds issue\\n\\nWhen eint virtual eint number is greater than gpio number,\\nit maybe produce \u0027desc[eint_n]\u0027 size globle-out-of-bounds issue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: pinctrl: mediatek: soluciona el problema global fuera de los l\u00edmites Cuando el n\u00famero eint virtual eint es mayor que el n\u00famero gpio, puede producir un tama\u00f1o \u0027desc[eint_n]\u0027 globle-out- cuesti\u00f3n de fuera de los l\u00edmites.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fb5fa8dc151b2364c975a9070eedb28a354a995a\",\"lessThan\":\"f373298e1bf0c6ea097c0bcc558dc43ad53e421f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb5fa8dc151b2364c975a9070eedb28a354a995a\",\"lessThan\":\"441d3873664d170982922c5d2fc01fa89d9439ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb5fa8dc151b2364c975a9070eedb28a354a995a\",\"lessThan\":\"fb563baa3eb8e7a15f2cff3c2695e2cca0493e69\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb5fa8dc151b2364c975a9070eedb28a354a995a\",\"lessThan\":\"2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.169\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.89\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.12\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-03-04T19:54:49.113562Z\",\"id\":\"CVE-2021-47083\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.169\",\"matchCriteriaId\":\"5EB80EB6-147D-4CC7-A133-69FB6AAB965B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.89\",\"matchCriteriaId\":\"2A2152BA-053D-4847-B29B-68F543546AB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.12\",\"matchCriteriaId\":\"732BA914-7B3B-43CD-857F-8119106F6F71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A73429BA-C2D9-4D0C-A75F-06A1CA8B3983\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F621B5E3-E99D-49E7-90B9-EC3B77C95383\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7BFDCAA-1650-49AA-8462-407DD593F94F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6EC9882F-866D-4ACB-8FBC-213D8D8436C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A0915FE-A4AA-4C94-B783-CF29D81E7E54\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fb563baa3eb8e7a15f2cff3c2695e2cca0493e69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fb563baa3eb8e7a15f2cff3c2695e2cca0493e69\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:10:02+00:00",
      "cve": "CVE-2021-47083",
      "id": "CVE-2021-47083",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: pinctrl: mediatek: fix global-out-of-bounds issue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47083.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:40:34Z",
      "cve": "CVE-2021-47083",
      "id": "CVE-2021-47083",
      "initial_release_date": "2024-03-06T04:52:30Z",
      "product_status:known_affected": "359",
      "product_status:known_not_affected": "231",
      "product_status:recommended": "535",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47083",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47083.json",
      "version": "56"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/fb563baa3eb8e7a15f2cff3c2695e2cca0493e69\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.666Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47083\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-04T19:54:49.113562Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:41.256Z\"}}], \"cna\": {\"title\": \"pinctrl: mediatek: fix global-out-of-bounds issue\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The OOB is in MediaTek pinctrl EINT\\u2192GPIO translation (`mtk_xt_get_gpio_n`), reached when a local caller requests an IRQ on a virtual GPIO (eint_n \\u2265 npins) via `/dev/gpiochipN` line-event ioctls \\u2192 `gpiod_to_irq` \\u2192 `request_threaded_irq` \\u2192 `mtk_eint_irq_request_resources`, not via network or physical plug-in paths.\\nAC:L - On SoCs with virtual EINTs (e.g. mt8195 GPIO156\\u2192eint 216 with npins=165), requesting edge detection on that line always indexes `desc[eint_n]` past the pin table; the attacker fully controls the trigger with no race or uncontrollable layout dependency.\\nPR:L - The gpio chardev ioctl path has no capability check\\u2014only DAC on `/dev/gpiochipN`, which on MediaTek phones, Chromebooks, IoT, and factory systems is commonly granted to non-root (gpio group/seat), matching prior gpiochip scoring (e.g. CVE-2022-48660); user-namespace root is not required.\\nUI:N - The attacker opens the gpiochip device and issues the line-event/edge ioctl themselves; no separate victim action is required.\\nS:U - Impact is confined to host-kernel memory safety within the same OS privilege domain; this is not a VM escape, IOMMU bypass, or other cross-authority boundary crossing.\\nC:H - The bug is a global out-of-bounds read of `desc[eint_n]` (and follow-on pin-desc fields on the false-match path); per kernel OOB-read guidance this is Confidentiality High.\\nI:N - The defect itself is an OOB read with no OOB write; a false greedy match yields gpio_n \\u2265 ngpio and fails `gpiochip_lock_as_irq` before `set_gpio_as_eint`/`mtk_hw_set_value`, so there is no write or control-flow integrity primitive.\\nA:H - Global OOB access is a kernel memory-safety violation that KASAN/hardened builds treat as oops-class failures, and a false-match path can drive `mtk_hw_get_value` with garbage register indices producing further faults, so availability impact is High.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fb5fa8dc151b2364c975a9070eedb28a354a995a\", \"lessThan\": \"f373298e1bf0c6ea097c0bcc558dc43ad53e421f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fb5fa8dc151b2364c975a9070eedb28a354a995a\", \"lessThan\": \"441d3873664d170982922c5d2fc01fa89d9439ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fb5fa8dc151b2364c975a9070eedb28a354a995a\", \"lessThan\": \"fb563baa3eb8e7a15f2cff3c2695e2cca0493e69\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fb5fa8dc151b2364c975a9070eedb28a354a995a\", \"lessThan\": \"2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.169\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.89\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f\"}, {\"url\": \"https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed\"}, {\"url\": \"https://git.kernel.org/stable/c/fb563baa3eb8e7a15f2cff3c2695e2cca0493e69\"}, {\"url\": \"https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npinctrl: mediatek: fix global-out-of-bounds issue\\n\\nWhen eint virtual eint number is greater than gpio number,\\nit maybe produce \u0027desc[eint_n]\u0027 size globle-out-of-bounds issue.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.169\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.89\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.12\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"4.20\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:45:54.954Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47083\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:45:54.954Z\", \"dateReserved\": \"2024-02-29T22:33:44.298Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-04T18:06:20.100Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.