CVE-2021-47097
📋 TL;DR
This is a stack buffer overflow vulnerability in the Linux kernel's Elantech touchpad driver. Attackers with local access can trigger memory corruption by sending specially crafted input to the touchpad interface, potentially leading to kernel crashes or arbitrary code execution. Systems using affected Linux kernel versions with Elantech touchpads are vulnerable.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel mode, allowing complete system compromise and persistence.
Likely Case
Kernel panic leading to system crash and denial of service.
If Mitigated
System remains stable with no impact if patched or workarounds applied.
🎯 Exploit Status
Requires local access and ability to interact with the touchpad input subsystem. Exploitation would require bypassing kernel protections like KASLR and SMAP/SMEP.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in kernel commits: 1d72d9f960ccf1052a0630a68c3d358791dbdaaa, 676c572439e58b7ee6b7ca3f1e5595382921045c, a7f95328c6f0afffdc4555f16e3bbab8bbf0d9be, dfd5b60b5342b6b505a104e48f08ad9b9bdbbd7b
Vendor Advisory: https://git.kernel.org/stable/c/1d72d9f960ccf1052a0630a68c3d358791dbdaaa
Restart Required: Yes
Instructions:
1. Update Linux kernel to a version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to install latest kernel updates. 3. Reboot system to load patched kernel.
🔧 Temporary Workarounds
Disable Elantech touchpad module
linuxBlacklist the psmouse module to prevent loading of vulnerable driver
echo 'blacklist psmouse' | sudo tee /etc/modprobe.d/blacklist-psmouse.conf
sudo rmmod psmouse
Restrict access to input devices
linuxChange permissions on input device files to prevent non-privileged access
sudo chmod 600 /dev/input/event*
sudo chown root:root /dev/input/event*
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local access
- Disable touchpad input if not required for system function
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if psmouse module is loaded: lsmod | grep psmouse && uname -rCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is after fix commits and check dmesg for absence of KASAN errors related to elantech📡 Detection & Monitoring
Log Indicators:
- KASAN stack-out-of-bounds errors in kernel logs
- Kernel panic messages related to psmouse or elantech
Network Indicators:
- None - local vulnerability only
SIEM Query:
source="kernel" AND ("KASAN" OR "stack-out-of-bounds" OR "elantech" OR "psmouse")🔗 References
- https://git.kernel.org/stable/c/1d72d9f960ccf1052a0630a68c3d358791dbdaaa
- https://git.kernel.org/stable/c/676c572439e58b7ee6b7ca3f1e5595382921045c
- https://git.kernel.org/stable/c/a7f95328c6f0afffdc4555f16e3bbab8bbf0d9be
- https://git.kernel.org/stable/c/dfd5b60b5342b6b505a104e48f08ad9b9bdbbd7b
- https://git.kernel.org/stable/c/1d72d9f960ccf1052a0630a68c3d358791dbdaaa
- https://git.kernel.org/stable/c/676c572439e58b7ee6b7ca3f1e5595382921045c
- https://git.kernel.org/stable/c/a7f95328c6f0afffdc4555f16e3bbab8bbf0d9be
- https://git.kernel.org/stable/c/dfd5b60b5342b6b505a104e48f08ad9b9bdbbd7b
