CVE-2021-47497

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells

If a cell has 'nbits' equal to a multiple of BITS_PER_BYTE the logic

*p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0);

will become undefined behavior because nbits modulo BITS_PER_BYTE is 0, and we

subtract one from that making a large number that is then shifted more than the

number of bits that fit into an unsigned long.

UBSAN reports this problem:

UBSAN: shift-out-of-bounds in drivers/nvmem/core.c:1386:8

shift exponent 64 is too large for 64-bit type 'unsigned long'

CPU: 6 PID: 7 Comm: kworker/u16:0 Not tainted 5.15.0-rc3+ #9

Hardware name: Google Lazor (rev3+) with KB Backlight (DT)

Workqueue: events_unbound deferred_probe_work_func

Call trace:

dump_backtrace+0x0/0x170

show_stack+0x24/0x30

dump_stack_lvl+0x64/0x7c

dump_stack+0x18/0x38

ubsan_epilogue+0x10/0x54

__ubsan_handle_shift_out_of_bounds+0x180/0x194

__nvmem_cell_read+0x1ec/

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References