| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-47055: mtd: require write permissions for locking and badblock ioctls |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| mtd: require write permissions for locking and badblock ioctls |
| |
| MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require |
| write permission. Depending on the hardware MEMLOCK might even be |
| write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK |
| is always write-once. |
| |
| MEMSETBADBLOCK modifies the bad block table. |
| |
| The Linux kernel CVE team has assigned CVE-2021-47055 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.4.233 with commit 1c9f9125892a43901438bf704ada6b7019e2a884 and fixed in 4.4.269 with commit f4d28d8b9b0e7c4ae04214b8d7e0b0466ec6bcaf |
| Issue introduced in 4.9.233 with commit 583d42400532fbd6228b0254d7c732b771e4750d and fixed in 4.9.269 with commit 9625b00cac6630479c0ff4b9fafa88bee636e1f0 |
| Issue introduced in 4.14.194 with commit 389c74c218d3b182e9cd767e98cee0e0fd0dabaa and fixed in 4.14.233 with commit f73b29819c6314c0ba8b7d5892dfb03487424bee |
| Issue introduced in 4.19.139 with commit ab1a602a9cea98aa37b2e6851b168d2a2633a58d and fixed in 4.19.191 with commit 75ed985bd6c8ac1d4e673e93ea9d96c9908c1d37 |
| Issue introduced in 5.4.58 with commit 9a53e8bd59d9f070505e51d3fd19606a270e6b93 and fixed in 5.4.119 with commit 5880afefe0cb9b2d5e801816acd58bfe91a96981 |
| Issue introduced in 5.9 with commit f7e6b19bc76471ba03725fe58e0c218a3d6266c3 and fixed in 5.10.37 with commit 7b6552719c0ccbbea29dde4be141da54fdb5877e |
| Issue introduced in 5.9 with commit f7e6b19bc76471ba03725fe58e0c218a3d6266c3 and fixed in 5.11.21 with commit 077259f5e777c3c8821f6b41dee709fcda27306b |
| Issue introduced in 5.9 with commit f7e6b19bc76471ba03725fe58e0c218a3d6266c3 and fixed in 5.12.4 with commit a08799d3e8c8088640956237c183f83463c39668 |
| Issue introduced in 5.9 with commit f7e6b19bc76471ba03725fe58e0c218a3d6266c3 and fixed in 5.13 with commit 1e97743fd180981bef5f01402342bb54bf1c6366 |
| Issue introduced in 5.7.15 with commit 36a8b2f49235e63ab3f901fe12e1b6732f075c2e |
| Issue introduced in 5.8.1 with commit eb3d82abc335624a5e8ecfb75aba0b684e2dc4db |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-47055 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/mtd/mtdchar.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/f4d28d8b9b0e7c4ae04214b8d7e0b0466ec6bcaf |
| https://git.kernel.org/stable/c/9625b00cac6630479c0ff4b9fafa88bee636e1f0 |
| https://git.kernel.org/stable/c/f73b29819c6314c0ba8b7d5892dfb03487424bee |
| https://git.kernel.org/stable/c/75ed985bd6c8ac1d4e673e93ea9d96c9908c1d37 |
| https://git.kernel.org/stable/c/5880afefe0cb9b2d5e801816acd58bfe91a96981 |
| https://git.kernel.org/stable/c/7b6552719c0ccbbea29dde4be141da54fdb5877e |
| https://git.kernel.org/stable/c/077259f5e777c3c8821f6b41dee709fcda27306b |
| https://git.kernel.org/stable/c/a08799d3e8c8088640956237c183f83463c39668 |
| https://git.kernel.org/stable/c/1e97743fd180981bef5f01402342bb54bf1c6366 |
