CVE-2021-47170 Affecting kernel-default-livepatch-devel package, versions <5.3.18-150300.59.158.1


Severity

Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.05% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES153-KERNELDEFAULTLIVEPATCHDEVEL-7722559
  • published20 Aug 2024
  • disclosed3 May 2024

Introduced: 3 May 2024

CVE-2021-47170  (opens in a new tab)

How to fix?

Upgrade SLES:15.3 kernel-default-livepatch-devel to version 5.3.18-150300.59.158.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-default-livepatch-devel package and not the kernel-default-livepatch-devel package as distributed by SLES. See How to fix? for SLES:15.3 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

USB: usbfs: Don't WARN about excessively large memory allocations

Syzbot found that the kernel generates a WARNing if the user tries to submit a bulk transfer through usbfs with a buffer that is way too large. This isn't a bug in the kernel; it's merely an invalid request from the user and the usbfs code does handle it correctly.

In theory the same thing can happen with async transfers, or with the packet descriptor table for isochronous transfers.

To prevent the MM subsystem from complaining about these bad allocation requests, add the __GFP_NOWARN flag to the kmalloc calls for these buffers.

CVSS Scores

version 3.1