Bug 1946965 (CVE-2021-31916) - CVE-2021-31916 kernel: out of bounds array access in drivers/md/dm-ioctl.c
Summary: CVE-2021-31916 kernel: out of bounds array access in drivers/md/dm-ioctl.c
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-31916
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1956197 1956198 1956199 1956200 1946966 1949682 1955627 1955628 1955629 1955630 1955631
Blocks: 1946967 1955255
TreeView+ depends on / blocked
 
Reported: 2021-04-07 11:37 UTC by Marian Rehak
Modified: 2021-11-09 20:23 UTC (History)
47 users (show)

Fixed In Version: Kernel 5.12
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash, a leak of internal kernel information, or a privilege escalation problem.
Clone Of:
Environment:
Last Closed: 2021-11-09 20:23:19 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4140 0 None None None 2021-11-09 17:22:12 UTC
Red Hat Product Errata RHSA-2021:4356 0 None None None 2021-11-09 18:24:49 UTC

Description Marian Rehak 2021-04-07 11:37:30 UTC 
An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash, a leak of internal kernel information, or a privilege escalation problem.

References:

https://github.com/torvalds/linux/commit/4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a
https://seclists.org/oss-sec/2021/q1/268
Comment 1 Marian Rehak 2021-04-07 11:38:13 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1946966]
Comment 2 Justin M. Forbes 2021-04-08 13:56:19 UTC 
Any upstream link to more info or a patch for this?
Comment 3 Rohit Keshri 2021-04-29 04:26:44 UTC 
External References:

https://github.com/torvalds/linux/commit/4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a
https://seclists.org/oss-sec/2021/q1/268
Comment 5 Justin M. Forbes 2021-04-29 22:27:51 UTC 
This was fixed for Fedora with the 5.11.11 stable kernel updates.
Comment 8 Rohit Keshri 2021-04-30 14:40:15 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 32 errata-xmlrpc 2021-11-09 17:22:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4140 https://access.redhat.com/errata/RHSA-2021:4140
Comment 33 errata-xmlrpc 2021-11-09 18:24:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4356 https://access.redhat.com/errata/RHSA-2021:4356
Comment 34 Product Security DevOps Team 2021-11-09 20:23:15 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-31916
Note You need to log in before you can comment on or make changes to this bug.