CVE-2021-47633

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.6.0

Description A bug was found in the Linux kernel during fuzzing, specifically in the ath5k eeprom read pcal info 5111 function. The issue arises when none of the curves are selected in the loop, causing the idx variable to exceed the bounds of the AR5K EEPROM N PD CURVES array. This leads to an out-of-bounds access and subsequent writes using the pd variable. A sanity check for idx has been added to resolve the issue.

Recommendations For Linux kernel versions prior to 5.6.0, consider applying the provided patch that adds a sanity check for idx in the ath5k eeprom read pcal info 5111 function to prevent out-of-bounds access. As a temporary workaround, restricting access to the vulnerable function or module may help minimize the risk of exploitation. However, since the patch is not tested with a real device, caution should be exercised when applying it.