{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47561", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-24T15:11:00.727Z", "datePublished": "2024-05-24T15:12:50.061Z", "dateUpdated": "2026-08-05T08:48:25.293Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:25.293Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: virtio: disable timeout handling\n\nIf a timeout is hit, it can result is incorrect data on the I2C bus\nand/or memory corruptions in the guest since the device can still be\noperating on the buffers it was given while the guest has freed them.\n\nHere is, for example, the start of a slub_debug splat which was\ntriggered on the next transfer after one transfer was forced to timeout\nby setting a breakpoint in the backend (rust-vmm/vhost-device):\n\n BUG kmalloc-1k (Not tainted): Poison overwritten\n First byte 0x1 instead of 0x6b\n Allocated in virtio_i2c_xfer+0x65/0x35c age=350 cpu=0 pid=29\n \t__kmalloc+0xc2/0x1c9\n \tvirtio_i2c_xfer+0x65/0x35c\n \t__i2c_transfer+0x429/0x57d\n \ti2c_transfer+0x115/0x134\n \ti2cdev_ioctl_rdwr+0x16a/0x1de\n \ti2cdev_ioctl+0x247/0x2ed\n \tvfs_ioctl+0x21/0x30\n \tsys_ioctl+0xb18/0xb41\n Freed in virtio_i2c_xfer+0x32e/0x35c age=244 cpu=0 pid=29\n \tkfree+0x1bd/0x1cc\n \tvirtio_i2c_xfer+0x32e/0x35c\n \t__i2c_transfer+0x429/0x57d\n \ti2c_transfer+0x115/0x134\n \ti2cdev_ioctl_rdwr+0x16a/0x1de\n \ti2cdev_ioctl+0x247/0x2ed\n \tvfs_ioctl+0x21/0x30\n \tsys_ioctl+0xb18/0xb41\n\nThere is no simple fix for this (the driver would have to always create\nbounce buffers and hold on to them until the device eventually returns\nthe buffers), so just disable the timeout support for now." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is reached via local i2c-dev ioctls (I2C_TIMEOUT/I2C_RDWR) on /dev/i2c-*, as shown in the commit splat through i2cdev_ioctl → virtio_i2c_xfer; it is not reachable from network packet processing.\nAC:L - An attacker who can open the i2c device can set I2C_TIMEOUT to 0 (or a tiny value) and then issue a transfer, forcing wait_for_completion_timeout to expire and free in-flight virtqueue buffers while the backend still owns them, so the UAF is reliably triggerable.\nPR:L - i2cdev_open/ioctl perform no capability checks; access is only DAC on /dev/i2c-*, which is commonly group-accessible (i2c) or more broadly exposed on embedded/Android virtio-i2c deployments, so an unprivileged local user can reach the bug.\nUI:N - The attacker opens the device and issues the ioctls themselves; no separate victim action is required.\nS:U - Corruption and impact remain inside the guest kernel running the virtio-i2c frontend (standard local privilege escalation), not a guest-to-host or other cross-authority escape.\nC:H - On timeout the driver frees DMA bounce buffers and virtio_i2c_req objects still referenced by the virtqueue, enabling host write-after-free into reused guest slab objects and thus arbitrary kernel memory disclosure primitives.\nI:H - The same use-after-free/write-after-free of freed kmalloc objects (demonstrated by the poison-overwrite splat) yields heap corruption exploitable for arbitrary kernel writes and control-flow hijacking, plus incorrect I2C bus data.\nA:H - The memory corruption can oops/panic the guest kernel (and even when not fully exploited, UAF of in-flight virtio buffers is an availability-breaking kernel memory safety failure)." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/i2c/busses/i2c-virtio.c" ], "versions": [ { "version": "3cfc88380413d20f777dc6648a38f683962e52bf", "lessThan": "cc432b0727ce404cc13e8f6b5ce29f412c3f9f1f", "status": "affected", "versionType": "git" }, { "version": "3cfc88380413d20f777dc6648a38f683962e52bf", "lessThan": "84e1d0bf1d7121759622dabf8fbef4c99ad597c5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/i2c/busses/i2c-virtio.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.6", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cc432b0727ce404cc13e8f6b5ce29f412c3f9f1f" }, { "url": "https://git.kernel.org/stable/c/84e1d0bf1d7121759622dabf8fbef4c99ad597c5" } ], "title": "i2c: virtio: disable timeout handling", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-10T18:51:06.665618Z", "id": "CVE-2021-47561", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-10T18:51:14.257Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.771Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/cc432b0727ce404cc13e8f6b5ce29f412c3f9f1f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/84e1d0bf1d7121759622dabf8fbef4c99ad597c5", "tags": [ "x_transferred" ] } ] } ] } }