{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47083", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-29T22:33:44.298Z", "datePublished": "2024-03-04T18:06:20.100Z", "dateUpdated": "2026-08-05T08:45:54.954Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:54.954Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: fix global-out-of-bounds issue\n\nWhen eint virtual eint number is greater than gpio number,\nit maybe produce 'desc[eint_n]' size globle-out-of-bounds issue." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The OOB is in MediaTek pinctrl EINT→GPIO translation (`mtk_xt_get_gpio_n`), reached when a local caller requests an IRQ on a virtual GPIO (eint_n ≥ npins) via `/dev/gpiochipN` line-event ioctls → `gpiod_to_irq` → `request_threaded_irq` → `mtk_eint_irq_request_resources`, not via network or physical plug-in paths.\nAC:L - On SoCs with virtual EINTs (e.g. mt8195 GPIO156→eint 216 with npins=165), requesting edge detection on that line always indexes `desc[eint_n]` past the pin table; the attacker fully controls the trigger with no race or uncontrollable layout dependency.\nPR:L - The gpio chardev ioctl path has no capability check—only DAC on `/dev/gpiochipN`, which on MediaTek phones, Chromebooks, IoT, and factory systems is commonly granted to non-root (gpio group/seat), matching prior gpiochip scoring (e.g. CVE-2022-48660); user-namespace root is not required.\nUI:N - The attacker opens the gpiochip device and issues the line-event/edge ioctl themselves; no separate victim action is required.\nS:U - Impact is confined to host-kernel memory safety within the same OS privilege domain; this is not a VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - The bug is a global out-of-bounds read of `desc[eint_n]` (and follow-on pin-desc fields on the false-match path); per kernel OOB-read guidance this is Confidentiality High.\nI:N - The defect itself is an OOB read with no OOB write; a false greedy match yields gpio_n ≥ ngpio and fails `gpiochip_lock_as_irq` before `set_gpio_as_eint`/`mtk_hw_set_value`, so there is no write or control-flow integrity primitive.\nA:H - Global OOB access is a kernel memory-safety violation that KASAN/hardened builds treat as oops-class failures, and a false-match path can drive `mtk_hw_get_value` with garbage register indices producing further faults, so availability impact is High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c" ], "versions": [ { "version": "fb5fa8dc151b2364c975a9070eedb28a354a995a", "lessThan": "f373298e1bf0c6ea097c0bcc558dc43ad53e421f", "status": "affected", "versionType": "git" }, { "version": "fb5fa8dc151b2364c975a9070eedb28a354a995a", "lessThan": "441d3873664d170982922c5d2fc01fa89d9439ed", "status": "affected", "versionType": "git" }, { "version": "fb5fa8dc151b2364c975a9070eedb28a354a995a", "lessThan": "fb563baa3eb8e7a15f2cff3c2695e2cca0493e69", "status": "affected", "versionType": "git" }, { "version": "fb5fa8dc151b2364c975a9070eedb28a354a995a", "lessThan": "2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c" ], "versions": [ { "version": "4.20", "status": "affected" }, { "version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.169", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.89", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.12", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.4.169" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.89" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f" }, { "url": "https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed" }, { "url": "https://git.kernel.org/stable/c/fb563baa3eb8e7a15f2cff3c2695e2cca0493e69" }, { "url": "https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d" } ], "title": "pinctrl: mediatek: fix global-out-of-bounds issue", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-47083", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-03-04T19:54:49.113562Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:22:07.207Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.666Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/fb563baa3eb8e7a15f2cff3c2695e2cca0493e69", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d", "tags": [ "x_transferred" ] } ] } ] } }