CVE-2021-47055

mtd: require write permissions for locking and badblock ioctls

State: Published
Severity: 7.1 High
Published: Feb 29, 2024
Updated: Aug 5, 2026
Reserved: Feb 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: require write permissions for locking and badblock ioctls

MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require write permission. Depending on the hardware MEMLOCK might even be write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK is always write-once.

MEMSETBADBLOCK modifies the bad block table.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1c9f9125892a43901438bf704ada6b7019e2a884 to before f4d28d8b9b0e7c4ae04214b8d7e0b0466ec6bcafAffected 583d42400532fbd6228b0254d7c732b771e4750d to before 9625b00cac6630479c0ff4b9fafa88bee636e1f0Affected 389c74c218d3b182e9cd767e98cee0e0fd0dabaa to before f73b29819c6314c0ba8b7d5892dfb03487424beeAffected ab1a602a9cea98aa37b2e6851b168d2a2633a58d to before 75ed985bd6c8ac1d4e673e93ea9d96c9908c1d37Affected 9a53e8bd59d9f070505e51d3fd19606a270e6b93 to before 5880afefe0cb9b2d5e801816acd58bfe91a96981Affected f7e6b19bc76471ba03725fe58e0c218a3d6266c3 to before 7b6552719c0ccbbea29dde4be141da54fdb5877eAffected f7e6b19bc76471ba03725fe58e0c218a3d6266c3 to before 077259f5e777c3c8821f6b41dee709fcda27306bAffected f7e6b19bc76471ba03725fe58e0c218a3d6266c3 to before a08799d3e8c8088640956237c183f83463c39668Affected f7e6b19bc76471ba03725fe58e0c218a3d6266c3 to before 1e97743fd180981bef5f01402342bb54bf1c6366Affected 36a8b2f49235e63ab3f901fe12e1b6732f075c2eAffected eb3d82abc335624a5e8ecfb75aba0b684e2dc4dbAffected 4.4.233 to before 4.4.269Affected 4.9.233 to before 4.9.269Affected 4.14.194 to before 4.14.233Affected 4.19.139 to before 4.19.191Affected 5.4.58 to before 5.4.119Affected 5.7.15 to before 5.8Affected 5.8.1 to before 5.9Affected
LinuxLinux	5.9Affected before 5.9Not affected 4.4.269 through 4.4.Not affected 4.9.269 through 4.9.Not affected 4.14.233 through 4.14.Not affected 4.19.191 through 4.19.Not affected 5.4.119 through 5.4.Not affected 5.10.37 through 5.10.Not affected 5.11.21 through 5.11.Not affected 5.12.4 through 5.12.Not affected 5.13 and laterNot affected

Product

Versions

LinuxLinux

1c9f9125892a43901438bf704ada6b7019e2a884 to before f4d28d8b9b0e7c4ae04214b8d7e0b0466ec6bcafAffected
583d42400532fbd6228b0254d7c732b771e4750d to before 9625b00cac6630479c0ff4b9fafa88bee636e1f0Affected
389c74c218d3b182e9cd767e98cee0e0fd0dabaa to before f73b29819c6314c0ba8b7d5892dfb03487424beeAffected
ab1a602a9cea98aa37b2e6851b168d2a2633a58d to before 75ed985bd6c8ac1d4e673e93ea9d96c9908c1d37Affected
9a53e8bd59d9f070505e51d3fd19606a270e6b93 to before 5880afefe0cb9b2d5e801816acd58bfe91a96981Affected
f7e6b19bc76471ba03725fe58e0c218a3d6266c3 to before 7b6552719c0ccbbea29dde4be141da54fdb5877eAffected
f7e6b19bc76471ba03725fe58e0c218a3d6266c3 to before 077259f5e777c3c8821f6b41dee709fcda27306bAffected
f7e6b19bc76471ba03725fe58e0c218a3d6266c3 to before a08799d3e8c8088640956237c183f83463c39668Affected
f7e6b19bc76471ba03725fe58e0c218a3d6266c3 to before 1e97743fd180981bef5f01402342bb54bf1c6366Affected
36a8b2f49235e63ab3f901fe12e1b6732f075c2eAffected
eb3d82abc335624a5e8ecfb75aba0b684e2dc4dbAffected
4.4.233 to before 4.4.269Affected
4.9.233 to before 4.9.269Affected
4.14.194 to before 4.14.233Affected
4.19.139 to before 4.19.191Affected
5.4.58 to before 5.4.119Affected
5.7.15 to before 5.8Affected
5.8.1 to before 5.9Affected

LinuxLinux

5.9Affected
before 5.9Not affected
4.4.269 through 4.4.*Not affected
4.9.269 through 4.9.*Not affected
4.14.233 through 4.14.*Not affected
4.19.191 through 4.19.*Not affected
5.4.119 through 5.4.*Not affected
5.10.37 through 5.10.*Not affected
5.11.21 through 5.11.*Not affected
5.12.4 through 5.12.*Not affected
5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.