CVE-2021-47039

What it actually does

Out-of-bounds array access in the ataflop floppy driver when do_format() indexes into the unit[].disk[] array using an unchecked 'type' value.

Why it matters to the business

Local users on systems exposing floppy disk support can trigger kernel crashes or memory corruption, leading to denial of service or potential privilege escalation on affected Linux kernels.

How an attack unfolds

An attacker with local access supplies a malformed format request to the ataflop driver; the do_format() function performs the array dereference before the bounds check on the supplied type value, resulting in an out-of-bounds read or write.

How to fix it

Update the Linux kernel to a version containing the commit that relocates the type bounds check to the beginning of do_format(). Rebuild and reboot with the patched kernel; disable the ataflop module if floppy support is unnecessary.

How to confirm the fix worked

Inspect kernel source for the ataflop.c do_format() function to confirm the bounds check precedes the array dereference; verify the running kernel version includes the fix or test with invalid type values in a non-production environment.

Typical attack path

1. Obtain local shell on target system
2. Open or ioctl the floppy device with crafted format parameters containing an out-of-range type index
3. Trigger the early array access in do_format() before the later bounds validation
4. Achieve kernel memory corruption or oops

How to detect it

Review kernel logs for oops or panic messages referencing ataflop and do_format; look for unexpected calls to floppy formatting ioctls from unprivileged processes in audit logs.

What your security team should do

• Apply the upstream kernel patch or distribution update containing the bounds-check relocation as soon as possible
• Remove or blacklist the ataflop module on systems that do not require floppy disk functionality
• Monitor for local privilege-escalation attempts targeting kernel floppy drivers