UBUNTU-CVE-2021-47633: Medium severity ubuntu/linux-azure vulnerability

Q: Which systems are exposed to this issue?

Systems running an affected Ubuntu kernel variant are potentially exposed when the ath5k wireless driver processes calibration data for the relevant hardware. The listed packages include Ubuntu linux, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-kvm, linux-fips, and linux-aws-fips.

Q: What must occur for the out-of-bounds write to be triggered?

The ath5k driver must reach the EEPROM power-calibration parsing path with curve-selection data such that no curve is selected in the relevant loop. This allows the index to reach AR5K_EEPROM_N_PD_CURVES and subsequently be used to access a power-curve array out of bounds.

Q: How could administrators identify a potentially affected condition?

The supplied fuzzing report shows KASAN reporting a slab-out-of-bounds write in ath5k_eeprom_read_pcal_info_5111 while the ath5k module was being loaded by modprobe. Similar KASAN traces referencing ath5k_eeprom_read_pcal_info_5111 or ath5k_eeprom_convert_pcal_info_5111 indicate the vulnerable parsing path has been reached.

Published Feb 26, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: ath5k: fix OOB in ath5keepromreadpcalinfo5111 The bug was found during fuzzing. Stacktrace locates it in ath5keepromconvertpcalinfo5111. When none of the curve is selected in the loop, idx can go up to AR5KEEPROMNPDCURVES. The line makes pd out of bound. pd = &chinfo[pier].pdcurves[idx]; There are many OOB writes using pd later in the code. So I added a sanity check for idx. Checks for other loops involving AR5KEEPROMNPDCURVES are not needed as the loop index is not used outside the loops. The patch is NOT tested with real device. The following is the fuzzing report BUG: KASAN: slab-out-of-bounds in ath5keepromreadpcalinfo5111+0x126a/0x1390 [ath5k] Write of size 1 at addr ffff8880174a4d60 by task modprobe/214 CPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1 Call Trace: dumpstack+0x76/0xa0 printaddressdescription.constprop.0+0x16/0x200 ? ath5keepromreadpcalinfo5111+0x126a/0x1390 [ath5k] ? ath5keepromreadpcalinfo5111+0x126a/0x1390 [ath5k] kasanreport.cold+0x37/0x7c ? ath5keepromreadpcalinfo5111+0x126a/0x1390 [ath5k] kasanreport+0xe/0x20 ath5keepromreadpcalinfo5111+0x126a/0x1390 [ath5k] ? apictimerinterrupt+0xa/0x20 ? ath5keeprominit11apcalfreq+0xbc0/0xbc0 [ath5k] ? ath5kpcieepromread+0x228/0x3c0 [ath5k] ath5keeprominit+0x2513/0x6290 [ath5k] ? ath5keeprominit11apcalfreq+0xbc0/0xbc0 [ath5k] ? usleeprange+0xb8/0x100 ? apictimerinterrupt+0xa/0x20 ? ath5keepromreadpcalinfo2413+0x2f20/0x2f20 [ath5k] ath5khwinit+0xb60/0x1970 [ath5k] ath5kinitah+0x6fe/0x2530 [ath5k] ? kasprintf+0xa6/0xe0 ? ath5kstop+0x140/0x140 [ath5k] ? devnotice+0xf6/0xf6 ? apictimerinterrupt+0xa/0x20 ath5kpciprobe.cold+0x29a/0x3d6 [ath5k] ? ath5kpcieepromread+0x3c0/0x3c0 [ath5k] ? mutexlock+0x89/0xd0 ? ath5kpcieepromread+0x3c0/0x3c0 [ath5k] localpciprobe+0xd3/0x160 pcideviceprobe+0x23f/0x3e0 ? pcideviceremove+0x280/0x280 ? pcideviceremove+0x280/0x280 reallyprobe+0x209/0x5d0

Affected Software

148 affected componentsFixes available

ubuntu/linux-azure<4.15.0-1146.161~14.04.1

4.15.0-1146.161~14.04.1

ubuntu/linux*

ubuntu/linux-aws<4.4.0-1162.168

4.4.0-1162.168

ubuntu/linux-lts-xenial<4.4.0-291.325~14.04.1

4.4.0-291.325~14.04.1

ubuntu/linux-aws-hwe<4.15.0-1137.148~16.04.1

4.15.0-1137.148~16.04.1

ubuntu/linux-azure<4.15.0-1146.161~16.04.1

4.15.0-1146.161~16.04.1

ubuntu/linux-gcp<4.15.0-1131.147~16.04.1

4.15.0-1131.147~16.04.1

ubuntu/linux-hwe<4.15.0-189.200~16.04.1

4.15.0-189.200~16.04.1

ubuntu/linux-oracle<4.15.0-1102.113~16.04.1

4.15.0-1102.113~16.04.1

ubuntu/linux<4.4.0-291.325

4.4.0-291.325

ubuntu/linux-aws<4.4.0-1200.215

4.4.0-1200.215

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm<4.4.0-1163.174

4.4.0-1163.174

ubuntu/linux-fips*

ubuntu/linux<4.15.0-189.200

4.15.0-189.200

ubuntu/linux-aws<4.15.0-1137.148

4.15.0-1137.148

ubuntu/linux-aws-5.4<5.4.0-1078.84~18.04.1

5.4.0-1078.84~18.04.1

ubuntu/linux-azure-4.15<4.15.0-1146.161

4.15.0-1146.161

ubuntu/linux-azure-5.4<5.4.0-1083.87~18.04.1

5.4.0-1083.87~18.04.1

ubuntu/linux-gcp-4.15<4.15.0-1131.147

4.15.0-1131.147

ubuntu/linux-gcp-5.4<5.4.0-1078.84~18.04.1

5.4.0-1078.84~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-117.132~18.04.1

5.4.0-117.132~18.04.1

ubuntu/linux-ibm-5.4<5.4.0-1028.32~18.04.1

5.4.0-1028.32~18.04.1

ubuntu/linux-kvm<4.15.0-1123.128

4.15.0-1123.128

ubuntu/linux-oracle<4.15.0-1102.113

4.15.0-1102.113

ubuntu/linux-oracle-5.4<5.4.0-1076.83~18.04.1

5.4.0-1076.83~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1065.75~18.04.1

5.4.0-1065.75~18.04.1

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2076.81

4.15.0-2076.81

ubuntu/linux-azure-fips<4.15.0-2057.63

4.15.0-2057.63

ubuntu/linux-fips<4.15.0-1094.105

4.15.0-1094.105

ubuntu/linux-gcp-fips<4.15.0-2041.46

4.15.0-2041.46

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-117.132

5.4.0-117.132

ubuntu/linux-aws<5.4.0-1078.84

5.4.0-1078.84

ubuntu/linux-azure<5.4.0-1083.87

5.4.0-1083.87

ubuntu/linux-azure-5.15<5.15.0-1008.9~20.04.1

5.15.0-1008.9~20.04.1

ubuntu/linux-bluefield<5.4.0-1040.44

5.4.0-1040.44

ubuntu/linux-gcp<5.4.0-1078.84

5.4.0-1078.84

ubuntu/linux-hwe-5.15<5.15.0-41.44~20.04.1

5.15.0-41.44~20.04.1

ubuntu/linux-ibm<5.4.0-1026.29

5.4.0-1026.29

ubuntu/linux-intel-iotg-5.15<5.15.0-1008.11~20.04.1

5.15.0-1008.11~20.04.1

ubuntu/linux-iot<5.4.0-1004.6

5.4.0-1004.6

ubuntu/linux-kvm<5.4.0-1068.72

5.4.0-1068.72

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-42.45~20.04.1

5.15.0-42.45~20.04.1

ubuntu/linux-oracle<5.4.0-1076.83

5.4.0-1076.83

ubuntu/linux-raspi<5.4.0-1065.75

5.4.0-1065.75

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1078.84+fips1

5.4.0-1078.84+fips1

ubuntu/linux-azure-fips<5.4.0-1083.87+fips1

5.4.0-1083.87+fips1

ubuntu/linux-fips<5.4.0-1054.61

5.4.0-1054.61

ubuntu/linux-gcp-fips<5.4.0-1078.84+fips1

5.4.0-1078.84+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-37.39

5.15.0-37.39

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1011.14

5.15.0-1011.14

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure<5.15.0-1010.12

5.15.0-1010.12

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1008.12

5.15.0-1008.12

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gke<5.15.0-1008.10

5.15.0-1008.10

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1007.8

5.15.0-1007.8

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1008.11

5.15.0-1008.11

ubuntu/linux-kvm<5.15.0-1010.11

5.15.0-1010.11

ubuntu/linux-lowlatency<5.15.0-37.39

5.15.0-37.39

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1009.12

5.15.0-1009.12

ubuntu/linux-oracle-6.5*

ubuntu/linux-raspi<5.15.0-1011.13

5.15.0-1011.13

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime<5.15.0-1014.14

5.15.0-1014.14

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1146.161~14.04.1
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1162.168
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-291.325~14.04.1
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1137.148~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1146.161~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1131.147~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-189.200~16.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1102.113~16.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-291.325
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1200.215
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1163.174
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-189.200
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1137.148
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1146.161
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1083.87~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1131.147
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-117.132~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1028.32~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1123.128
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1102.113
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1076.83~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1065.75~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2076.81
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2057.63
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1094.105
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2041.46
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-117.132
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1083.87
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.9~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1040.44
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-41.44~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1026.29
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.11~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1004.6
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1068.72
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-42.45~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1076.83
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1065.75
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1083.87+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1054.61
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-37.39
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1011.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1010.12
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.12
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.10
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1007.8
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.11
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1010.11
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-37.39
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1009.12
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1011.13
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1014.14
Compensating control
Add a sanity check for idx in ath5k_eeprom_read_pcal_info_5111 before evaluating pd = &chinfo[pier].pd_curves[idx], preventing idx from reaching AR5K_EEPROM_N_PD_CURVES and causing out-of-bounds writes.

Event History

Feb 26, 2025

CVE Published

via OSV·06:37 AM

Data Sourced

via OSV·06:37 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running an affected Ubuntu kernel variant are potentially exposed when the ath5k wireless driver processes calibration data for the relevant hardware. The listed packages include Ubuntu linux, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-kvm, linux-fips, and linux-aws-fips.

What must occur for the out-of-bounds write to be triggered?

The ath5k driver must reach the EEPROM power-calibration parsing path with curve-selection data such that no curve is selected in the relevant loop. This allows the index to reach AR5K_EEPROM_N_PD_CURVES and subsequently be used to access a power-curve array out of bounds.

How could administrators identify a potentially affected condition?

The supplied fuzzing report shows KASAN reporting a slab-out-of-bounds write in ath5k_eeprom_read_pcal_info_5111 while the ath5k module was being loaded by modprobe. Similar KASAN traces referencing ath5k_eeprom_read_pcal_info_5111 or ath5k_eeprom_convert_pcal_info_5111 indicate the vulnerable parsing path has been reached.

UBUNTU-CVE-2021-47633: Medium severity ubuntu/linux-azure vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must occur for the out-of-bounds write to be triggered?

How could administrators identify a potentially affected condition?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must occur for the out-of-bounds write to be triggered?

How could administrators identify a potentially affected condition?