CVE-2021-47288

What it actually does

Out-of-bounds write in the ngene media driver caused by memcpy of 6 bytes into a 1-byte struct member of the incorrect FW_CONFIGURE_BUFFERS structure instead of the intended FW_CONFIGURE_FREE_BUFFERS structure.

Why it matters to the business

Kernel memory corruption in systems using the ngene driver can lead to system instability or crashes with low likelihood of remote exploitation.

How an attack unfolds

An attacker with local access or the ability to trigger media device configuration commands invokes ngene_command_config_free_buf with crafted parameters that cause the oversized memcpy to overwrite adjacent kernel memory.

How to fix it

Update the Linux kernel to a version containing the fix for the ngene driver out-of-bounds memcpy in ngene_command_config_free_buf.

How to confirm the fix worked

Confirm the kernel source no longer contains the oversized memcpy targeting &com.cmd.ConfigureBuffers.config and that compilation with -Warray-bounds produces no warning for this path.

Typical attack path

1. Obtain local access or load a malicious module that interacts with the ngene device
2. Trigger ngene_command_config_free_buf via ioctl or media subsystem call
3. Supply input that reaches the vulnerable memcpy into the undersized config member
4. Overwrite kernel structures to achieve denial of service or attempt privilege escalation

How to detect it

Review kernel logs for array-bounds warnings during compilation or runtime oops/panics referencing ngene_command_config_free_buf or FW_CONFIGURE_FREE_BUFFERS; inspect dmesg for memory corruption indicators near media subsystem calls.

• ngene_command_config_free_buf
• FW_CONFIGURE_FREE_BUFFERS
• ConfigureBuffers.config
• __builtin_memcpy offset [12, 16]

What your security team should do

• Apply the upstream kernel fix for CVE-2021-47288 on all affected systems
• Monitor for kernel oops or panic reports involving ngene functions
• Limit exposure by restricting untrusted access to media devices using the ngene driver