CVE-2021-47605

What it actually does

Unchecked user-supplied config.offset in vduse_dev_ioctl allows out-of-bounds subtraction on u32 values, resulting in memory corruption via large resulting length passed to subsequent operations.

Why it matters to the business

Potential system instability, crashes, or escalation to kernel-level code execution on Linux hosts using the nvduse driver, though low observed exploitation rates reduce immediate widespread risk.

How an attack unfolds

An attacker with local access invokes the vduse_dev_ioctl syscall supplying a malicious config structure whose offset exceeds dev->config_size; the missing bounds check produces an underflowed u32 length that writes beyond allocated memory, enabling corruption that can be leveraged for code execution.

How to fix it

Apply the upstream kernel patch that adds the bounds check on config.offset before the subtraction; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Confirm the presence of the bounds-check commit in the running kernel source or verify that vduse_dev_ioctl rejects out-of-range offsets via targeted fuzzing or unit tests.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux system
2. Open the vduse device file descriptor
3. Craft and submit an ioctl request with oversized config.offset
4. Trigger the subtraction that yields an oversized length
5. Corrupt adjacent kernel memory structures
6. Escalate to arbitrary code execution or denial of service

How to detect it

Review kernel audit logs and syscall traces for unusual ioctl calls to vduse devices with large offset values; examine crash dumps for signs of out-of-bounds writes in the nvduse module.

What your security team should do

• Prioritize patching Linux kernels that expose the nvduse driver within the next maintenance window
• Monitor EPSS and KEV feeds for any future increase in exploit maturity
• Restrict unprivileged access to vduse device nodes via permissions or LSM policies where feasible