CVE-2021-47282 is an out-of-bounds write vulnerability in the Linux kernel's bcm2835 SPI driver, affecting systems with more than 3 SPI slaves configured via GPIO chipselects. This flaw could lead to high impact on confidentiality, integrity, and availability (CVSS 7.8 HIGH). While the vulnerability is not listed in CISA's KEV catalog and has no known public exploits or significant community discussion, its local attack vector and low attack complexity make it a notable risk. A band-aid fix has been implemented, increasing the allowed slaves to 24 and enforcing the limitation during slave setup.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.4, < 5.4.126CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.5, < 5.10.44CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.11, < 5.12.11CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
5.13CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:* | ||
5.13CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.