External risk intelligence

Linux Kernel isofs Out-of-Bounds Read Advisory

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2021-47478

The vulnerability exists in the Linux kernel isofs (ISO 9660) file system driver. Exploitation requires an attacker to provide a specially crafted, malicious ISO image to a system that mounts it. This is typically a local operation or requires specific user interaction to mount external media, making it very unlikely to be reachable via the public internet in standard deployment patterns.

Out-of-bounds Read

Linux Kernel

before 4.4.2924.5 to before 4.9.2904.10 to before 4.14.2554.15 to before 4.19.2174.20 to before 5.4.1595.5 to before 5.10.795.11 to before 5.14.185.15 to before 5.15.2

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's file system handling could allow unauthorized access to data if a corrupted ISO image is processed. This issue affects the way the kernel reads file system information, potentially exposing sensitive information. The main concern is confirming relevance and exposure within your environment.

A file system flaw can expose data.
Understand if your systems use this feature.
Assess potential exposure of sensitive information.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by providing a corrupted ISO image to a system. If the system attempts to read information from this image, the `isofs_read_inode()` function could read data beyond the intended buffer. This could lead to unintended consequences when the system processes the corrupted data.

Requires a corrupted ISO image.
Triggered by reading the image.
Risk of unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

When an `isofs` image is corrupted, the Linux kernel's `isofs` driver could read data beyond its allocated buffer. This vulnerability could affect the integrity of system operations when a specially crafted, corrupted `isofs` image is mounted.

System data integrity.
Mounting a corrupted `isofs` image.
Potential for system instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's isofs module, which allows for an out-of-bounds read when processing a corrupted ISO image, impacts systems where this module is active and exposed to untrusted ISO images. Infrastructure or platform teams managing the Linux kernel are likely responsible. The first practical move is to identify systems with the affected kernel versions, determine if they mount external ISO images, and confirm the criticality of those systems before planning remediation.

Kernel and platform teams own resolution.
Verify systems mounting external ISOs.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel isofs module?

The isofs module is a component of the Linux kernel used to read ISO 9660 file systems, which are the standard format for CD-ROM and DVD media. It allows the operating system to interpret the file structure and access data contained on these discs or disk image files.

What does CWE-125 mean for CVE-2021-47478?

CWE-125 refers to an out-of-bounds read vulnerability. In this specific case, the kernel's file system driver fails to properly verify the size of directory entries within an ISO image. As a result, the system may attempt to read data from memory addresses outside of the allocated buffer, potentially causing instability or unauthorized data access.

What triggers the vulnerability in the isofs driver?

This vulnerability is triggered when the Linux kernel processes a specially crafted, corrupted ISO image. It does not trigger during normal operation with standard, valid ISO files. The issue specifically occurs when the system performs a read operation on a malicious image designed to exploit the missing sanity checks in the file system code.

How do I evaluate my risk regarding this CVE?

According to Halo Surface Signal, this vulnerability is very unlikely to be reachable via the public internet. Exploitation requires an attacker to provide a malicious ISO image to a system that subsequently mounts it. You should prioritize systems that frequently mount external media or untrusted disk images, as these are the primary vectors for this issue.

What are the first steps to handle this vulnerability?

Begin by identifying which of your systems are running the affected Linux kernel versions. Once identified, evaluate if those machines are configured to mount external or untrusted ISO images. If they are, coordinate with your infrastructure or platform teams to prioritize those systems for kernel updates provided by your distribution vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.