CVE-2021-47580: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47580 affects the Linux kernel's SCSI debug module. The vulnerability was discovered in the scsidebug driver where using mint() with type "int" instead of "u32" leads to stack out-of-bounds access. The issue was disclosed in June 2024 and affects the Linux kernel SCSI subsystem (NVD).

The vulnerability occurs due to improper type usage in mint() function calls within the scsidebug driver. When using type "int", values get sign extended, causing the larger value to be used and resulting in stack out-of-bounds access. This manifests as a KASAN (Kernel Address Sanitizer) reported stack-out-of-bounds error in memcpy operations (Kernel Commit).

The vulnerability can lead to stack buffer overflow conditions in the Linux kernel's SCSI subsystem. According to CISA's assessment, this vulnerability has a CVSS v3.1 Base Score of 6.6 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (NVD).

The fix involves changing min_t() to use type "u32" instead of "int" in the affected code paths. This has been patched in the Linux kernel through multiple commits. Users should update to a patched kernel version that includes these fixes (Kernel Commit).