CVE-2021-47478

What it actually does

Out-of-bounds memory read in isofs_read_inode() when processing a corrupted ISO9660 image due to missing validation of directory entry length, allowing access past the end of the allocated buffer.

Why it matters to the business

Systems handling untrusted or potentially corrupted ISO images may experience kernel instability, crashes, or limited memory disclosure, disrupting operations that rely on optical disc image mounting.

How an attack unfolds

An attacker supplies a malformed ISO image crafted to contain an invalid directory entry length. When the target system mounts or accesses the image, the isofs driver performs an unchecked read beyond buffer bounds in isofs_read_inode().

How to fix it

Apply the upstream kernel patch that adds a sanity check on directory entry length before use in isofs_read_inode(); rebuild and deploy updated kernels to affected systems.

How to confirm the fix worked

Confirm presence of the directory-entry-length sanity check in the isofs inode-reading code path; attempt to mount known malformed test images and verify no out-of-bounds access occurs.

Typical attack path

1. Craft a corrupted ISO9660 image with manipulated directory entry lengths
2. Deliver the malicious image to the target environment
3. Trick the system or user into mounting the image
4. Trigger isofs_read_inode() on the malformed entry to induce out-of-bounds access

How to detect it

Inspect kernel logs and crash dumps for isofs module faults or out-of-bounds read indicators when ISO images are mounted; correlate with user or process activity involving image files.

What your security team should do

• Update Linux kernels to versions containing the isofs directory entry length validation fix
• Restrict mounting of ISO images from untrusted sources via policy or tools
• Monitor kernel logs for isofs-related faults or panics as an interim detection measure