What’s Vulnerable › Vulnerabilities

CVE-2021-47478: isofs: Fix out of bound access for corrupted isofs image

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-22 · updated 2026-08-04
• Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image When isofs image is suitably corrupted isofs_read_inode() can read data beyond the end of buffer. Sanity-check the directory entry length before using it.

Affected products

• Linux kernel: before 4.4.292; from 4.5 before 4.9.290; from 4.10 before 4.14.255; from 4.15 before 4.19.217; from 4.20 before 5.4.159; from 5.5 before 5.10.79 — fixed in 4.14.255, 4.19.217, 4.4.292, 4.9.290, 5.10.79, 5.14.18

How to fix

Upgrade to a fixed version: Linux kernel 4.14.255, 4.19.217, 4.4.292, 4.9.290. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/156ce5bb6cc43a80a743810199defb1dc3f55b7f
• https://git.kernel.org/stable/c/6e80e9314f8bb52d9eabe1907698718ff01120f5
• https://git.kernel.org/stable/c/86d4aedcbc69c0f84551fb70f953c24e396de2d7
• https://git.kernel.org/stable/c/9ec33a9b8790c212cc926a88c5e2105f97f3f57e
• https://git.kernel.org/stable/c/afbd40f425227e661d991757e11cc4db024e761f
• https://git.kernel.org/stable/c/b0ddff8d68f2e43857a84dce54c3deab181c8ae1
• https://git.kernel.org/stable/c/b2fa1f52d22c5455217b294629346ad23a744945
• https://git.kernel.org/stable/c/e7fb722586a2936b37bdff096c095c30ca06404d
• https://git.kernel.org/stable/c/e96a1866b40570b5950cda8602c2819189c62a48
• https://git.kernel.org/stable/c/156ce5bb6cc43a80a743810199defb1dc3f55b7f
• https://git.kernel.org/stable/c/6e80e9314f8bb52d9eabe1907698718ff01120f5
• https://git.kernel.org/stable/c/86d4aedcbc69c0f84551fb70f953c24e396de2d7

Get alerted when CVE-2021-47478 or the next vulnerability affects your stack