CVE-2021-47309
net: validate lwtstate->data before returning from skb_tunnel_info()
At a glance
- Source
- NVD
- EPSS
- EPSS 0.25 % · percentile 16 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: net: validate lwtstate->data before returning from skb_tunnel_info() skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible. So skb_tunnel_info() should validate before returning that pointer. Splat looks like: BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811 CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 Call Trace: dump_stack_lvl+0x56/0x7b print_address_description.constprop.8.cold.13+0x13/0x2ee ? vxlan_get_route+0x418/0x4b0 [vxlan] ? vxlan_get_route+0x418/0x4b0 [vxlan] kasan_report.cold.14+0x83/0xdf ? vxlan_get_route+0x418/0x4b0 [vxlan] vxlan_get_route+0x418/0x4b0 [vxlan] [ ... ] vxlan_xmit_one+0x148b/0x32b0 [vxlan] [ ... ] vxlan_xmit+0x25c5/0x4780 [vxlan] [ ... ] dev_hard_start_xmit+0x1ae/0x6e0 __dev_queue_xmit+0x1f39/0x31a0 [ ... ] neigh_xmit+0x2f9/0x940 mpls_xmit+0x911/0x1600 [mpls_iptunnel] lwtunnel_xmit+0x18f/0x450 ip_finish_output2+0x867/0x2040 [ ... ]
Weaknesses (CWE)
- CWE-125 — Out-of-bounds Read
References
- https://git.kernel.org/stable/c/e7f3c9df40515a6c6b46f36c4c94cf48a043f887
- https://git.kernel.org/stable/c/b61d327cd3cc5ea591f3bf751dd11e034f388bb5
- https://git.kernel.org/stable/c/83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d
- https://git.kernel.org/stable/c/8bb1589c89e61e3b182dd546f1021928ebb5c2a6
- https://git.kernel.org/stable/c/8aa13a86964cdec4fd969ef677c6614ff068641a
- https://git.kernel.org/stable/c/2179d96ec702cc33ead02a9ce40ece599b8538c5
- https://git.kernel.org/stable/c/a915379594f1e045421635c6316d8f3ffa018c58
- https://git.kernel.org/stable/c/67a9c94317402b826fc3db32afc8f39336803d97
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-34314
- GCVE · GCVE-0-2021-47309
CERT-FR advisories
- CERTFR-2024-AVI-0610 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0578 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.3 < 4.4.277cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.5 < 4.9.277cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.10 < 4.14.241cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.15 < 4.19.199cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.135cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.53cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.13.5cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < e7f3c9df40515a6c6b46f36c4c94cf48a043f887 ; affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < b61d327cd3cc5ea591f3bf751dd11e034f388bb5 ; affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < 83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d ; affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < 8bb1589c89e61e3b182dd546f1021928ebb5c2a6 ; affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < 8aa13a86964cdec4fd969ef677c6614ff068641a ; affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < 2179d96ec702cc33ead02a9ce40ece599b8538c5 |
| Linux · Linux | affected 4.3 ; unaffected 0 < 4.3 ; unaffected 4.4.277 ≤ 4.4.* ; unaffected 4.9.277 ≤ 4.9.* ; unaffected 4.14.241 ≤ 4.14.* ; unaffected 4.19.199 ≤ 4.19.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |