LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47339: media: v4l2-core: explicitly clear ioctl input data

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: explicitly clear ioctl input data As seen from a recent syzbot bug report, mistakes in the compat ioctl implementation can lead to uninitialized kernel stack data getting used as input for driver ioctl handlers. The reported bug is now fixed, but it's possible that other related bugs are still present or get added in the future. As the drivers need to check user input already, the possible impact is fairly low, but it might still cause an information leak. To be on the safe side, always clear the entire ioctl buffer before calling the conversion handler functions that are meant to initialize them.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2021-47339 is a Linux kernel media subsystem issue where some video ioctl handling could use uncleared kernel stack data. The source describes the likely impact as fairly low, but it could still lead to an information leak. There is no cited evidence of active exploitation.

Executive priority

Treat this as routine patch management unless your environment exposes Linux media interfaces to untrusted users. The available evidence points to low impact and no confirmed active exploitation, but kernel information leaks still merit timely remediation through normal update cycles.

Technical view

The issue is in Linux v4l2-core compat ioctl conversion. Uninitialized kernel stack data could be passed as input to driver ioctl handlers. The kernel fix clears the entire ioctl buffer before conversion handlers initialize fields, reducing the chance of stale stack data affecting downstream driver behavior.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions listed in the CVE source, especially systems using the media/V4L2 subsystem. The bundle references Linux kernel versions including 5.11, 5.12.18, 5.13.3, and 5.14, but distribution-specific affected ranges are not provided.

Exploitation context

The CVE source links the issue to a syzbot-reported bug class and says related mistakes could cause information leaks. The record is not in KEV, and the supplied sources do not report exploitation in the wild or provide a public exploit status.

Researcher notes

The source frames this as defensive hardening after a syzbot report: clearing ioctl buffers prevents uninitialized stack data from entering driver handlers. The record lacks CVSS, CWE mapping, distribution-specific ranges, and exploitation evidence, so validation should rely on kernel commit presence or distributor backport notices.

Mitigation direction

  • Identify Linux hosts with affected kernel versions from the CVE record.
  • Apply kernel or distribution updates that include the referenced stable fixes.
  • Check Linux distribution advisories for backported fix status.
  • Prioritize internet-facing or untrusted-user systems using media/V4L2 features.
  • Track vendor guidance if your distribution version mapping is unclear.

Validation and detection

  • Record kernel versions across Linux assets and compare with vendor advisories.
  • Confirm installed kernel packages include the stable fix commits or distributor backports.
  • Review whether V4L2/media device access is available to untrusted users.
  • Run existing regression tests for media workloads after kernel updates.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47339 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8dbcc3fa387c16abfc88a628cf528c439c91b332, 8dbcc3fa387c16abfc88a628cf528c439c91b332, 8dbcc3fa387c16abfc88a628cf528c439c91b332unaffected
LinuxLinux5.11, 0, 5.12.18, 5.13.3, 5.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.