CVE-2021-47097

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.13.0-22-generic #22+arighi20211110

Description The vulnerability is related to a stack out-of-bounds access in the elantech change report id() function. The param[] array in elantech change report id() must be at least 3 bytes, but it is defined as an array of 2 bytes, leading to a potential stack out-of-bounds access. This issue is confirmed by KASAN. The vulnerability can be exploited to cause a denial of service.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for the stack out-of-bounds access in elantech change report id(). Specifically, update to a version later than 5.13.0-22-generic #22+arighi20211110.

Note: The provided input descriptions do not include information about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. Therefore, this information is not included in the description.