GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47604 (GCVE-0-2021-47604)

Vulnerability from cvelistv5 – Published: 2024-06-19 14:54 – Updated: 2026-08-05 08:48
VLAI
Title
vduse: check that offset is within bounds in get_config()
Summary
In the Linux kernel, the following vulnerability has been resolved: vduse: check that offset is within bounds in get_config() This condition checks "len" but it does not check "offset" and that could result in an out of bounds read if "offset > dev->config_size". The problem is that since both variables are unsigned the "dev->config_size - offset" subtraction would result in a very high unsigned value. I think these checks might not be necessary because "len" and "offset" are supposed to already have been validated using the vhost_vdpa_config_validate() function. But I do not know the code perfectly, and I like to be safe.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:12 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c8a6153b6c59d95c0e091f053f6f180952ade91e , < ebbbc5fea3f648175df1aa3f127c78eb0252cc2a (git)
Affected: c8a6153b6c59d95c0e091f053f6f180952ade91e , < dc1db0060c02d119fd4196924eff2d1129e9a442 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.11 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:47:40.211Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ebbbc5fea3f648175df1aa3f127c78eb0252cc2a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dc1db0060c02d119fd4196924eff2d1129e9a442"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47604",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:12:14.372380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:51.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vdpa/vdpa_user/vduse_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ebbbc5fea3f648175df1aa3f127c78eb0252cc2a",
              "status": "affected",
              "version": "c8a6153b6c59d95c0e091f053f6f180952ade91e",
              "versionType": "git"
            },
            {
              "lessThan": "dc1db0060c02d119fd4196924eff2d1129e9a442",
              "status": "affected",
              "version": "c8a6153b6c59d95c0e091f053f6f180952ade91e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vdpa/vdpa_user/vduse_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.11",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: check that offset is within bounds in get_config()\n\nThis condition checks \"len\" but it does not check \"offset\" and that\ncould result in an out of bounds read if \"offset \u003e dev-\u003econfig_size\".\nThe problem is that since both variables are unsigned the\n\"dev-\u003econfig_size - offset\" subtraction would result in a very high\nunsigned value.\n\nI think these checks might not be necessary because \"len\" and \"offset\"\nare supposed to already have been validated using the\nvhost_vdpa_config_validate() function.  But I do not know the code\nperfectly, and I like to be safe."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable get_config path is reached through local interfaces (vhost-vdpa ioctl VHOST_VDPA_GET_CONFIG or virtio-vdpa config reads after attaching a VDUSE device), not via network packets.\nAC:L - The attacker fully controls offset and length through the ioctl (or by creating a VDUSE device with a small config_size and feature bits that cause larger-offset reads); no race or other condition beyond attacker control is required.\nPR:L - Exploitation requires access to vhost-vdpa/VDUSE device nodes that are commonly granted to non-root virtualization users (e.g., qemu/kvm group), not capabilities that are only available to real root in the init user namespace.\nUI:N - No victim interaction is needed; the attacker triggers the OOB read directly via ioctl or by attaching/probing the malicious VDUSE device.\nS:U - Impact is confined to the host kernel and the calling process (kernel memory disclosure or oops); this does not cross a VM/IOMMU/sandbox security authority boundary by itself.\nC:H - The underflow allows an unbounded out-of-bounds read from kernel memory past the config buffer, and on the vhost-vdpa path that data is copied to userspace via copy_to_user, enabling arbitrary kernel memory disclosure.\nI:N - The bug is a pure out-of-bounds read (memcpy from config+offset into a destination buffer) with no write primitive or integrity modification of kernel state.\nA:H - A sufficiently large or far OOB read can access unmapped memory and cause a kernel oops/panic, resulting in a full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:33.959Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ebbbc5fea3f648175df1aa3f127c78eb0252cc2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc1db0060c02d119fd4196924eff2d1129e9a442"
        }
      ],
      "title": "vduse: check that offset is within bounds in get_config()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47604",
    "datePublished": "2024-06-19T14:54:03.664Z",
    "dateReserved": "2024-05-24T15:11:00.736Z",
    "dateUpdated": "2026-08-05T08:48:33.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47604",
      "date": "2026-09-15",
      "epss": "0.00211",
      "percentile": "0.115"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15\", \"versionEndExcluding\": \"5.15.11\", \"matchCriteriaId\": \"7A70FD7B-2EDC-4C3B-ADE0-880AA759CDD7\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvduse: check that offset is within bounds in get_config()\\n\\nThis condition checks \\\"len\\\" but it does not check \\\"offset\\\" and that\\ncould result in an out of bounds read if \\\"offset \u003e dev-\u003econfig_size\\\".\\nThe problem is that since both variables are unsigned the\\n\\\"dev-\u003econfig_size - offset\\\" subtraction would result in a very high\\nunsigned value.\\n\\nI think these checks might not be necessary because \\\"len\\\" and \\\"offset\\\"\\nare supposed to already have been validated using the\\nvhost_vdpa_config_validate() function.  But I do not know the code\\nperfectly, and I like to be safe.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vduse: verifique que el desplazamiento est\\u00e9 dentro de los l\\u00edmites en get_config() Esta condici\\u00f3n verifica \\\"len\\\" pero no verifica \\\"desplazamiento\\\" y eso podr\\u00eda resultar en una lectura fuera de los l\\u00edmites si \\\" desplazamiento \u0026gt; dev-\u0026gt;config_size\\\". El problema es que, dado que ambas variables no est\\u00e1n firmadas, la resta \\\"dev-\u0026gt;config_size - offset\\\" dar\\u00eda como resultado un valor sin firmar muy alto. Creo que estas comprobaciones podr\\u00edan no ser necesarias porque se supone que \\\"len\\\" y \\\"offset\\\" ya se han validado mediante la funci\\u00f3n vhost_vdpa_config_validate(). Pero no conozco el c\\u00f3digo a la perfecci\\u00f3n y me gusta estar seguro.\"}]",
      "id": "CVE-2021-47604",
      "lastModified": "2024-11-21T06:36:39.020",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.2}]}",
      "published": "2024-06-19T15:15:54.973",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/dc1db0060c02d119fd4196924eff2d1129e9a442\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ebbbc5fea3f648175df1aa3f127c78eb0252cc2a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dc1db0060c02d119fd4196924eff2d1129e9a442\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ebbbc5fea3f648175df1aa3f127c78eb0252cc2a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47604\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T15:15:54.973\",\"lastModified\":\"2026-08-04T10:17:10.467\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvduse: check that offset is within bounds in get_config()\\n\\nThis condition checks \\\"len\\\" but it does not check \\\"offset\\\" and that\\ncould result in an out of bounds read if \\\"offset \u003e dev-\u003econfig_size\\\".\\nThe problem is that since both variables are unsigned the\\n\\\"dev-\u003econfig_size - offset\\\" subtraction would result in a very high\\nunsigned value.\\n\\nI think these checks might not be necessary because \\\"len\\\" and \\\"offset\\\"\\nare supposed to already have been validated using the\\nvhost_vdpa_config_validate() function.  But I do not know the code\\nperfectly, and I like to be safe.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vduse: verifique que el desplazamiento est\u00e9 dentro de los l\u00edmites en get_config() Esta condici\u00f3n verifica \\\"len\\\" pero no verifica \\\"desplazamiento\\\" y eso podr\u00eda resultar en una lectura fuera de los l\u00edmites si \\\" desplazamiento \u0026gt; dev-\u0026gt;config_size\\\". El problema es que, dado que ambas variables no est\u00e1n firmadas, la resta \\\"dev-\u0026gt;config_size - offset\\\" dar\u00eda como resultado un valor sin firmar muy alto. Creo que estas comprobaciones podr\u00edan no ser necesarias porque se supone que \\\"len\\\" y \\\"offset\\\" ya se han validado mediante la funci\u00f3n vhost_vdpa_config_validate(). Pero no conozco el c\u00f3digo a la perfecci\u00f3n y me gusta estar seguro.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/vdpa/vdpa_user/vduse_dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c8a6153b6c59d95c0e091f053f6f180952ade91e\",\"lessThan\":\"ebbbc5fea3f648175df1aa3f127c78eb0252cc2a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8a6153b6c59d95c0e091f053f6f180952ade91e\",\"lessThan\":\"dc1db0060c02d119fd4196924eff2d1129e9a442\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/vdpa/vdpa_user/vduse_dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.11\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:12:14.372380Z\",\"id\":\"CVE-2021-47604\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.11\",\"matchCriteriaId\":\"7A70FD7B-2EDC-4C3B-ADE0-880AA759CDD7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/dc1db0060c02d119fd4196924eff2d1129e9a442\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ebbbc5fea3f648175df1aa3f127c78eb0252cc2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc1db0060c02d119fd4196924eff2d1129e9a442\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ebbbc5fea3f648175df1aa3f127c78eb0252cc2a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:01:54+00:00",
      "cve": "CVE-2021-47604",
      "id": "CVE-2021-47604",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vduse: check that offset is within bounds in get_config()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47604.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:36:33Z",
      "cve": "CVE-2021-47604",
      "id": "CVE-2021-47604",
      "initial_release_date": "2024-06-21T03:52:15Z",
      "product_status:known_affected": "330",
      "product_status:known_not_affected": "311",
      "product_status:recommended": "298",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47604",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47604.json",
      "version": "51"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ebbbc5fea3f648175df1aa3f127c78eb0252cc2a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dc1db0060c02d119fd4196924eff2d1129e9a442\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:47:40.211Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47604\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:12:14.372380Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:26.373Z\"}}], \"cna\": {\"title\": \"vduse: check that offset is within bounds in get_config()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable get_config path is reached through local interfaces (vhost-vdpa ioctl VHOST_VDPA_GET_CONFIG or virtio-vdpa config reads after attaching a VDUSE device), not via network packets.\\nAC:L - The attacker fully controls offset and length through the ioctl (or by creating a VDUSE device with a small config_size and feature bits that cause larger-offset reads); no race or other condition beyond attacker control is required.\\nPR:L - Exploitation requires access to vhost-vdpa/VDUSE device nodes that are commonly granted to non-root virtualization users (e.g., qemu/kvm group), not capabilities that are only available to real root in the init user namespace.\\nUI:N - No victim interaction is needed; the attacker triggers the OOB read directly via ioctl or by attaching/probing the malicious VDUSE device.\\nS:U - Impact is confined to the host kernel and the calling process (kernel memory disclosure or oops); this does not cross a VM/IOMMU/sandbox security authority boundary by itself.\\nC:H - The underflow allows an unbounded out-of-bounds read from kernel memory past the config buffer, and on the vhost-vdpa path that data is copied to userspace via copy_to_user, enabling arbitrary kernel memory disclosure.\\nI:N - The bug is a pure out-of-bounds read (memcpy from config+offset into a destination buffer) with no write primitive or integrity modification of kernel state.\\nA:H - A sufficiently large or far OOB read can access unmapped memory and cause a kernel oops/panic, resulting in a full denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c8a6153b6c59d95c0e091f053f6f180952ade91e\", \"lessThan\": \"ebbbc5fea3f648175df1aa3f127c78eb0252cc2a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8a6153b6c59d95c0e091f053f6f180952ade91e\", \"lessThan\": \"dc1db0060c02d119fd4196924eff2d1129e9a442\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/vdpa/vdpa_user/vduse_dev.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/vdpa/vdpa_user/vduse_dev.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ebbbc5fea3f648175df1aa3f127c78eb0252cc2a\"}, {\"url\": \"https://git.kernel.org/stable/c/dc1db0060c02d119fd4196924eff2d1129e9a442\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvduse: check that offset is within bounds in get_config()\\n\\nThis condition checks \\\"len\\\" but it does not check \\\"offset\\\" and that\\ncould result in an out of bounds read if \\\"offset \u003e dev-\u003econfig_size\\\".\\nThe problem is that since both variables are unsigned the\\n\\\"dev-\u003econfig_size - offset\\\" subtraction would result in a very high\\nunsigned value.\\n\\nI think these checks might not be necessary because \\\"len\\\" and \\\"offset\\\"\\nare supposed to already have been validated using the\\nvhost_vdpa_config_validate() function.  But I do not know the code\\nperfectly, and I like to be safe.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.11\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:33.959Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47604\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:33.959Z\", \"dateReserved\": \"2024-05-24T15:11:00.736Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T14:54:03.664Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.