LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47576: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() In resp_mode_select() sanity check the block descriptor len to avoid UAF. BUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 Read of size 1 at addr ffff888026670f50 by task scsicmd/15032 CPU: 1 PID: 15032 Comm: scsicmd Not tainted 5.15.0-01d0625 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Call Trace: <TASK> dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:107 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:257 kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:443 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 schedule_resp+0x4af/0x1a10 drivers/scsi/scsi_debug.c:5483 scsi_debug_queuecommand+0x8c9/0x1e70 drivers/scsi/scsi_debug.c:7537 scsi_queue_rq+0x16b4/0x2d10 drivers/scsi/scsi_lib.c:1521 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1640 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358 __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1762 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1839 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:63 sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:837 sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:775 sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:941 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1166 __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:52 do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:50 entry_SYSCALL_64_after_hwframe+0x44/0xae arch/x86/entry/entry_64.S:113

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory safety bug in the scsi_debug driver, a SCSI testing/debug component. A malformed mode select interaction could trigger a use-after-free. Business urgency is mainly for systems that load scsi_debug or expose SCSI generic device access, not typical remote-facing services.

Executive priority

Handle in normal kernel patch cycles, faster for labs, CI, virtualization hosts, or storage test systems where scsi_debug is used. No source evidence supports emergency internet-wide response.

Technical view

The flaw is in drivers/scsi/scsi_debug.c resp_mode_select(), where block descriptor length lacked sanity checking. The source includes a KASAN use-after-free trace reached through sg ioctl handling and SCSI request processing. Kernel stable commits add the bounds check across affected branches.

Likely exposure

Likely exposure is limited to Linux systems running affected kernels with scsi_debug available and usable. This driver is commonly used for testing rather than normal production storage. The trace indicates local SCSI generic ioctl interaction, not remote network exposure.

Exploitation context

The bundle does not show public exploitation, exploit code, or CISA KEV listing. It provides a kernel sanitizer crash trace and stable fix references. Treat this as a local kernel memory safety issue with constrained prerequisites unless vendor advisories say otherwise.

Researcher notes

The affected path is scsi_debug mode select handling. The provided trace reaches resp_mode_select() via sg ioctl and scsi_debug_queuecommand(). Impact beyond use-after-free is not characterized in the bundle; avoid assuming privilege escalation without additional evidence.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Check vendor advisories for exact fixed package versions.
  • Disable or avoid loading scsi_debug where it is not required.
  • Restrict access to SCSI generic devices to trusted users.
  • Prioritize systems used for kernel, storage, or virtualization testing.

Validation and detection

  • Inventory Linux kernel versions against the affected and fixed branches.
  • Confirm whether the scsi_debug module is present or loaded.
  • Review device permissions for SCSI generic interfaces.
  • Verify the deployed kernel includes one referenced fix commit.
  • Check vendor security notes for distribution-specific backports.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47576 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux231839102b54512ced7d3ee7fc9b8bcf5e3b583b, 231839102b54512ced7d3ee7fc9b8bcf5e3b583b, 231839102b54512ced7d3ee7fc9b8bcf5e3b583b, 231839102b54512ced7d3ee7fc9b8bcf5e3b583b, 231839102b54512ced7d3ee7fc9b8bcf5e3b583b, 231839102b54512ced7d3ee7fc9b8bcf5e3b583b, 231839102b54512ced7d3ee7fc9b8bcf5e3b583bunaffected
LinuxLinux2.6.19, 0, 4.9.294, 4.14.259, 4.19.222, 5.4.168, 5.10.88, 5.15.11, 5.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.