{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47153","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-03-04T18:12:48.846Z","datePublished":"2024-03-25T09:07:47.873Z","dateUpdated":"2026-08-05T08:46:21.812Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:46:21.812Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: i801: Don't generate an interrupt on bus reset\n\nNow that the i2c-i801 driver supports interrupts, setting the KILL bit\nin a attempt to recover from a timed out transaction triggers an\ninterrupt. Unfortunately, the interrupt handler (i801_isr) is not\nprepared for this situation and will try to process the interrupt as\nif it was signaling the end of a successful transaction. In the case\nof a block transaction, this can result in an out-of-range memory\naccess.\n\nThis condition was reproduced several times by syzbot:\nhttps://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e\nhttps://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e\nhttps://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e\nhttps://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb\nhttps://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a\nhttps://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79\n\nSo disable interrupts while trying to reset the bus. Interrupts will\nbe enabled again for the following transaction."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached locally via /dev/i2c-* I2C_SMBUS ioctls into i801_access → i801_block_transaction_byte_by_byte → i801_check_post; it is not reachable from network packet processing or physical SMBus injection.\nAC:L - An attacker who can open the adapter can issue block SMBus transactions and force wait_event_timeout to expire (including via I2C_TIMEOUT), reliably hitting the KILL path that leaves INTREN set; syzbot reproduced this repeatedly with no attacker-uncontrollable race required.\nPR:L - i2cdev_open() performs no capability check—access is only DAC on /dev/i2c-*. On realistic worst-case deployments (i2c group or similarly relaxed permissions on developer/embedded/x86 systems with Intel PCH SMBus), a non-root local user can reach the path.\nUI:N - The attacker opens the device and issues the ioctls themselves; no separate victim action is required.\nS:U - Impact is ordinary in-kernel stack/memory corruption within the host kernel authority, not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:H - The ISR performs out-of-range accesses on the block buffer (KASAN OOB reads) and related crashes show use-after-free of that buffer; this class of memory corruption is scored as enabling high confidentiality impact under the higher-severity rule.\nI:H - Syzbot also hit out-of-bounds/use-after-free writes in i801_isr_byte_done for the same root cause (KILL-generated interrupt while INTREN remains set), giving stack/heap corruption exploitable for control-flow hijacking.\nA:H - The memory-safety failure reliably produces kernel oops/KASAN reports and can panic the system, which is Availability High under kernel CVSS guidance."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/i2c/busses/i2c-i801.c"],"versions":[{"version":"636752bcb5177a301d0266270661581de8624828","lessThan":"f9469082126cebb7337db3992d143f5e4edfe629","status":"affected","versionType":"git"},{"version":"636752bcb5177a301d0266270661581de8624828","lessThan":"09c9e79f4c10cfb6b9e0e1b4dd355232e4b5a3b3","status":"affected","versionType":"git"},{"version":"636752bcb5177a301d0266270661581de8624828","lessThan":"dfa8929e117b0228a7765f5c3f5988a4a028f3c6","status":"affected","versionType":"git"},{"version":"636752bcb5177a301d0266270661581de8624828","lessThan":"c70e1ba2e7e65255a0ce004f531dd90dada97a8c","status":"affected","versionType":"git"},{"version":"636752bcb5177a301d0266270661581de8624828","lessThan":"04cc05e3716ae31b17ecdab7bc55c8170def1b8b","status":"affected","versionType":"git"},{"version":"636752bcb5177a301d0266270661581de8624828","lessThan":"b523feb7e8e44652f92f3babb953a976e7ccbbef","status":"affected","versionType":"git"},{"version":"636752bcb5177a301d0266270661581de8624828","lessThan":"1f583d3813f204449037cd2acbfc09168171362a","status":"affected","versionType":"git"},{"version":"636752bcb5177a301d0266270661581de8624828","lessThan":"e4d8716c3dcec47f1557024add24e1f3c09eb24b","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/i2c/busses/i2c-i801.c"],"versions":[{"version":"3.6","status":"affected"},{"version":"0","lessThan":"3.6","status":"unaffected","versionType":"semver"},{"version":"4.4.271","lessThanOrEqual":"4.4.*","status":"unaffected","versionType":"semver"},{"version":"4.9.271","lessThanOrEqual":"4.9.*","status":"unaffected","versionType":"semver"},{"version":"4.14.235","lessThanOrEqual":"4.14.*","status":"unaffected","versionType":"semver"},{"version":"4.19.193","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.124","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.42","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.12.9","lessThanOrEqual":"5.12.*","status":"unaffected","versionType":"semver"},{"version":"5.13","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"4.4.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"4.9.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"4.14.235"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"4.19.193"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.4.124"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.10.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.12.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.13"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f9469082126cebb7337db3992d143f5e4edfe629"},{"url":"https://git.kernel.org/stable/c/09c9e79f4c10cfb6b9e0e1b4dd355232e4b5a3b3"},{"url":"https://git.kernel.org/stable/c/dfa8929e117b0228a7765f5c3f5988a4a028f3c6"},{"url":"https://git.kernel.org/stable/c/c70e1ba2e7e65255a0ce004f531dd90dada97a8c"},{"url":"https://git.kernel.org/stable/c/04cc05e3716ae31b17ecdab7bc55c8170def1b8b"},{"url":"https://git.kernel.org/stable/c/b523feb7e8e44652f92f3babb953a976e7ccbbef"},{"url":"https://git.kernel.org/stable/c/1f583d3813f204449037cd2acbfc09168171362a"},{"url":"https://git.kernel.org/stable/c/e4d8716c3dcec47f1557024add24e1f3c09eb24b"}],"title":"i2c: i801: Don't generate an interrupt on bus reset","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-03-25T19:20:15.941507Z","id":"CVE-2021-47153","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-11-05T16:55:32.968Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T05:24:39.990Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/f9469082126cebb7337db3992d143f5e4edfe629","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/09c9e79f4c10cfb6b9e0e1b4dd355232e4b5a3b3","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/dfa8929e117b0228a7765f5c3f5988a4a028f3c6","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c70e1ba2e7e65255a0ce004f531dd90dada97a8c","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/04cc05e3716ae31b17ecdab7bc55c8170def1b8b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b523feb7e8e44652f92f3babb953a976e7ccbbef","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1f583d3813f204449037cd2acbfc09168171362a","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e4d8716c3dcec47f1557024add24e1f3c09eb24b","tags":["x_transferred"]}]}]}}