Security readout for executives and security teams
Plain-English summary
CVE-2021-47478 is a Linux kernel flaw in ISO 9660 filesystem handling. A deliberately corrupted ISO image can make the kernel read beyond an internal buffer. The documented impact is information exposure, not data modification or service outage. The source bundle does not show active exploitation.
Executive priority
Treat this as a routine kernel patching and exposure-control item, not an emergency. Prioritize systems that ingest user-supplied ISO images, shared workstations, build infrastructure, and removable-media workflows.
Technical view
The issue is a CWE-125 out-of-bounds read in isofs_read_inode(). The fix adds a sanity check for directory entry length before use. CVSS 3.1 is 5.5 with local attack vector, low complexity, low privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.
Likely exposure
Exposure is most relevant to Linux systems that mount or process untrusted, corrupted ISO 9660 images. Systems that never handle user-supplied ISO images have lower practical exposure. Exact affected distro package ranges are not provided in the bundle.
Exploitation context
The CVE is not listed as KEV in the provided data, and the bundle gives no cited evidence of active exploitation. The attack model is local and requires a corrupted ISOFS image reaching vulnerable kernel parsing code.
Researcher notes
The provided evidence supports an out-of-bounds read fixed in upstream stable commits. It does not include proof-of-concept details, exploit telemetry, or distribution-specific vulnerable package ranges. Validation should focus on kernel provenance and whether untrusted ISOFS data can reach isofs_read_inode().
Mitigation direction
- Apply vendor kernel updates that include the listed stable kernel fixes.
- Restrict mounting or automated processing of untrusted ISO images.
- Check Linux distribution advisories for exact package versions and backports.
- Review systems that accept uploaded disk images or removable media.
Validation and detection
- Identify Linux hosts that support or mount ISO 9660 filesystems.
- Check running and installed kernel versions against vendor advisories.
- Confirm whether the kernel includes the isofs directory entry length sanity check.
- Review image-processing workflows for untrusted ISO inputs.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 156ce5bb6cc4
- Linux stable commit 9ec33a9b8790
- Linux stable commit afbd40f42522
- Linux stable commit b0ddff8d68f2
- Linux stable commit 6e80e9314f8b
- Linux stable commit 86d4aedcbc69
- Linux stable commit b2fa1f52d22c
- Linux stable commit e7fb722586a2
- Linux stable commit e96a1866b405
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47478 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/156ce5bb6cc43a80a743810199defb1dc3f55b7fCVE reference, Linux
- https://git.kernel.org/stable/c/9ec33a9b8790c212cc926a88c5e2105f97f3f57eCVE reference, Linux
- https://git.kernel.org/stable/c/afbd40f425227e661d991757e11cc4db024e761fCVE reference, Linux
- https://git.kernel.org/stable/c/b0ddff8d68f2e43857a84dce54c3deab181c8ae1CVE reference, Linux
- https://git.kernel.org/stable/c/6e80e9314f8bb52d9eabe1907698718ff01120f5CVE reference, Linux
- https://git.kernel.org/stable/c/86d4aedcbc69c0f84551fb70f953c24e396de2d7CVE reference, Linux
- https://git.kernel.org/stable/c/b2fa1f52d22c5455217b294629346ad23a744945CVE reference, Linux
- https://git.kernel.org/stable/c/e7fb722586a2936b37bdff096c095c30ca06404dCVE reference, Linux
- https://git.kernel.org/stable/c/e96a1866b40570b5950cda8602c2819189c62a48CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.