CVE-2021-47240: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47240 is a vulnerability in the Linux kernel's QRTR (Qualcomm IPC Router) subsystem, specifically in the qrtr_endpoint_post function. The vulnerability was discovered by Syzbot and disclosed in May 2024. It affects Linux kernel versions from 4.15 through 5.13-rc6, impacting various Linux distributions that use these kernel versions (NVD).

The vulnerability is an out-of-bounds read issue in the qrtr_endpoint_post function. The root cause was an incorrect size type declaration (unsigned int instead of size_t). When the size parameter from qrtr_hdr is set to 4294967293 (0xfffffffd), the ALIGN(size, 4) operation results in 0. In cases where len equals hdrlen and size equals 4294967293 in the header, the validation check fails to catch the issue, leading to an out-of-bounds read operation through skb_put_data(skb, data + hdrlen, size) from the hdrlen allocated block. The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High) (NVD).

This vulnerability could allow an attacker to read memory outside of allocated bounds, potentially leading to information disclosure or system crashes. The vulnerability requires local access and low privileges to exploit, but can result in high confidentiality and availability impacts (NVD).

The vulnerability requires local access with low privileges to exploit. It has been confirmed to be exploitable through specially crafted input to the QRTR subsystem, as demonstrated by the Syzbot testing system (Kernel Patch).

The vulnerability has been fixed by changing the size variable type from 'unsigned int' to 'size_t' in the qrtr_endpoint_post function. The fix has been implemented across multiple kernel versions through various patches (Kernel Patch). Users should update to patched kernel versions to mitigate this vulnerability.