{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47352", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T14:28:16.985Z", "datePublished": "2024-05-21T14:35:56.473Z", "dateUpdated": "2026-08-05T08:47:24.845Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:47:24.845Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: Add validation for used length\n\nThis adds validation for used length (might come\nfrom an untrusted device) to avoid data corruption\nor loss." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The used length is taken from the virtio used ring written by the device backend (hypervisor/vhost/VDUSE), not from packet payload, so a remote network peer cannot forge it; exploitation requires a locally attached malicious virtio-net device.\nAC:L - The attacker fully controls the used-ring length field and can reliably supply an oversized value on every completed RX buffer with no race or other conditions outside their control.\nPR:N - No privileges on the victim guest are required; a malicious virtio backend can kick the RX virtqueue and the NAPI path in receive_small/receive_mergeable processes the forged length automatically.\nUI:N - Exploitation occurs entirely in the automatic softirq/NAPI receive path when the device completes buffers; no user action is needed.\nS:U - Impact is confined to the guest kernel that runs the virtio-net driver; this is host/device-to-guest corruption within that OS authority, not a guest-to-host or cross-VM escape.\nC:H - An oversized used length can overlap skb_shared_info or drive XDP with a past-the-end data_end, yielding out-of-bounds reads of adjacent kernel memory; memory-corruption bugs of this class are scored C:H.\nI:H - The same oversized length enables skb_shared_info / buffer corruption and XDP out-of-bounds writes before the post-XDP mergeable check, which is exploitable for integrity compromise and control-flow hijacking as the fix notes (data corruption).\nA:H - Lengths beyond skb tailroom hit skb_over_panic, and corrupted RX/sk_buff state can oops or panic the guest kernel, so availability impact is High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/virtio_net.c" ], "versions": [ { "version": "f6b10209b90d48a84f886ab2b317b5d2cbfe3143", "lessThan": "c1b40d1959517ff2ea473d40eeab4691d6d62462", "status": "affected", "versionType": "git" }, { "version": "f6b10209b90d48a84f886ab2b317b5d2cbfe3143", "lessThan": "c92298d228f61589dd21657af2bea95fc866b813", "status": "affected", "versionType": "git" }, { "version": "f6b10209b90d48a84f886ab2b317b5d2cbfe3143", "lessThan": "3133e01514c3c498f2b01ff210ee6134b70c663c", "status": "affected", "versionType": "git" }, { "version": "f6b10209b90d48a84f886ab2b317b5d2cbfe3143", "lessThan": "ba710baa1cc1b17a0483f7befe03e696efd17292", "status": "affected", "versionType": "git" }, { "version": "f6b10209b90d48a84f886ab2b317b5d2cbfe3143", "lessThan": "ad993a95c508417acdeb15244109e009e50d8758", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/virtio_net.c" ], "versions": [ { "version": "4.11", "status": "affected" }, { "version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.293", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.51", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.12.18", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.13.3", "lessThanOrEqual": "5.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.4.293" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.10.51" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.12.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.13.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c1b40d1959517ff2ea473d40eeab4691d6d62462" }, { "url": "https://git.kernel.org/stable/c/c92298d228f61589dd21657af2bea95fc866b813" }, { "url": "https://git.kernel.org/stable/c/3133e01514c3c498f2b01ff210ee6134b70c663c" }, { "url": "https://git.kernel.org/stable/c/ba710baa1cc1b17a0483f7befe03e696efd17292" }, { "url": "https://git.kernel.org/stable/c/ad993a95c508417acdeb15244109e009e50d8758" } ], "title": "virtio-net: Add validation for used length", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.505Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/c92298d228f61589dd21657af2bea95fc866b813", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/3133e01514c3c498f2b01ff210ee6134b70c663c", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ba710baa1cc1b17a0483f7befe03e696efd17292", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ad993a95c508417acdeb15244109e009e50d8758", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-47352", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:38:39.694535Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:48.464Z" } } ] } }