CVE-2021-47172: iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers
First published: Mon Mar 25 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers Channel numbering must start at 0 and then not have any holes, or it is possible to overflow the available storage. Note this bug was introduced as part of a fix to ensure we didn't rely on the ordering of child nodes. So we need to support arbitrary ordering but they all need to be there somewhere. Note I hit this when using qemu to test the rest of this series. Arguably this isn't the best fix, but it is probably the most minimal option for backporting etc. Alexandru's sign-off is here because he carried this patch in a larger set that Jonathan then applied.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Kernel-devel | ||
| Linux Kernel | >=5.4.14<5.4.124 | |
| Linux Kernel | >=5.5<5.10.42 | |
| Linux Kernel | >=5.11<5.12.9 | |
| Linux Kernel | =5.13-rc1 | |
| Linux Kernel | =5.13-rc2 | |
| Linux Kernel | =5.13-rc3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-47172?
CVE-2021-47172 has a medium severity rating due to the risk of overflow in the Linux kernel affecting the iio: adc: ad7124 driver.
How do I fix CVE-2021-47172?
To fix CVE-2021-47172, ensure you are running an updated version of the Linux kernel where this vulnerability has been patched.
What impact does CVE-2021-47172 have on systems?
CVE-2021-47172 can lead to potential overflow issues in the iio: adc: ad7124 driver, possibly affecting system stability and functionality.
Which versions of the Linux kernel are affected by CVE-2021-47172?
CVE-2021-47172 affects certain versions of the Linux kernel that utilize the iio: adc: ad7124 driver with non-sequential channel numbers.
Is CVE-2021-47172 exploitable remotely?
CVE-2021-47172 is not considered remotely exploitable as it requires local access to the affected system to exploit the vulnerability.
- agent/references
- agent/title
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/severity
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- vendor/linux
- canonical/red hat kernel-devel
- canonical/linux kernel
- version/linux kernel/5.4.14
- version/linux kernel/5.5
- version/linux kernel/5.11
- version/linux kernel/5.13-rc1
- version/linux kernel/5.13-rc2
- version/linux kernel/5.13-rc3