CVE-2021-47547

net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound

State: Published
Severity: 4.4 Medium
Published: May 24, 2024
Updated: May 11, 2026
Reserved: May 24, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound

In line 5001, if all id in the array 'lp->phy[8]' is not 0, when the 'for' end, the 'k' is 8.

At this time, the array 'lp->phy[8]' may be out of bound.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ec5bd0aef1cec96830d0c7e06d3597d9e786cc98Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 142ead3dc70411bd5977e8c47a6d8bf22287b3f8Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d3dedaa5a601107cfedda087209772c76e364d58Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2c1a6a9a011d622a7c61324a97a49801ba425effAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 77ff166909458646e66450e42909e0adacc99049Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f059fa40f0fcc6bc7a12e0f2a2504e9a4ff74f1fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 12f907cb11576b8cd0b1d95a16d1f10ed5bb7237Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 61217be886b5f7402843677e4be7e7e83de9cb41Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.4.294 through 4.4.Not affected 4.9.292 through 4.9.Not affected 4.14.257 through 4.14.Not affected 4.19.220 through 4.19.Not affected 5.4.164 through 5.4.Not affected 5.10.84 through 5.10.Not affected 5.15.7 through 5.15.*Not affected 5.16 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ec5bd0aef1cec96830d0c7e06d3597d9e786cc98Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 142ead3dc70411bd5977e8c47a6d8bf22287b3f8Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d3dedaa5a601107cfedda087209772c76e364d58Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2c1a6a9a011d622a7c61324a97a49801ba425effAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 77ff166909458646e66450e42909e0adacc99049Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f059fa40f0fcc6bc7a12e0f2a2504e9a4ff74f1fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 12f907cb11576b8cd0b1d95a16d1f10ed5bb7237Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 61217be886b5f7402843677e4be7e7e83de9cb41Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.4.294 through 4.4.*Not affected
4.9.292 through 4.9.*Not affected
4.14.257 through 4.14.*Not affected
4.19.220 through 4.19.*Not affected
5.4.164 through 5.4.*Not affected
5.10.84 through 5.10.*Not affected
5.15.7 through 5.15.*Not affected
5.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.