356 lines
18 KiB
JSON
356 lines
18 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2021-47309",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-05-21T14:28:16.972Z",
|
||
"datePublished": "2024-05-21T14:35:27.981Z",
|
||
"dateUpdated": "2026-08-05T08:47:13.551Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:47:13.551Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: validate lwtstate->data before returning from skb_tunnel_info()\n\nskb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info\ntype without validation. lwtstate->data can have various types such as\nmpls_iptunnel_encap, etc and these are not compatible.\nSo skb_tunnel_info() should validate before returning that pointer.\n\nSplat looks like:\nBUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan]\nRead of size 2 at addr ffff888106ec2698 by task ping/811\n\nCPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195\nCall Trace:\n dump_stack_lvl+0x56/0x7b\n print_address_description.constprop.8.cold.13+0x13/0x2ee\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n kasan_report.cold.14+0x83/0xdf\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n vxlan_get_route+0x418/0x4b0 [vxlan]\n [ ... ]\n vxlan_xmit_one+0x148b/0x32b0 [vxlan]\n [ ... ]\n vxlan_xmit+0x25c5/0x4780 [vxlan]\n [ ... ]\n dev_hard_start_xmit+0x1ae/0x6e0\n __dev_queue_xmit+0x1f39/0x31a0\n [ ... ]\n neigh_xmit+0x2f9/0x940\n mpls_xmit+0x911/0x1600 [mpls_iptunnel]\n lwtunnel_xmit+0x18f/0x450\n ip_finish_output2+0x867/0x2040\n [ ... ]"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - Exploitation requires locally configuring a non-IP LWT route (e.g. MPLS encap) whose output device is a tunnel that calls skb_tunnel_info() (VXLAN/GENEVE), then sending traffic on that path via netlink/syscalls—not a remote packet-only entry point.\nAC:L - Once the LWT-over-tunnel topology is set up, the bug triggers reliably on ordinary transmit (as in the reported ping splat); the attacker fully controls configuration and packet generation with no race or luck required.\nPR:L - Creating VXLAN/GENEVE devices and MPLS/other LWT routes needs CAP_NET_ADMIN, which an unprivileged user obtains in a user+net namespace (unshare -Urn); after setup even a normal local send triggers the OOB.\nUI:N - No victim action is required; the attacker configures the netns topology and sends packets themselves.\nS:U - Impact stays within the kernel’s own authority (local memory corruption/DoS/privilege escalation); this is not a VM, IOMMU, or other cross-boundary escape.\nC:H - skb_tunnel_info() type-confuses a small mpls_iptunnel_encap (or similar) as a much larger ip_tunnel_info, producing unbounded slab out-of-bounds reads of adjacent kernel heap that can disclose memory (e.g. via tunnel key fields or BPF get_tunnel_key).\nI:H - This is heap type confusion; on collect-metadata VXLAN/GENEVE paths the bogus info drives &info->dst_cache and related state, enabling out-of-bounds writes into adjacent heap when those fields are attacker-influenced.\nA:H - The documented KASAN slab-out-of-bounds in vxlan_get_route demonstrates a kernel oops/crash path, and invalid heap accesses can panic or hang the machine."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"include/net/dst_metadata.h"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "61adedf3e3f1d3f032c5a6a299978d91eff6d555",
|
||
"lessThan": "e7f3c9df40515a6c6b46f36c4c94cf48a043f887",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "61adedf3e3f1d3f032c5a6a299978d91eff6d555",
|
||
"lessThan": "b61d327cd3cc5ea591f3bf751dd11e034f388bb5",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "61adedf3e3f1d3f032c5a6a299978d91eff6d555",
|
||
"lessThan": "83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "61adedf3e3f1d3f032c5a6a299978d91eff6d555",
|
||
"lessThan": "8bb1589c89e61e3b182dd546f1021928ebb5c2a6",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "61adedf3e3f1d3f032c5a6a299978d91eff6d555",
|
||
"lessThan": "8aa13a86964cdec4fd969ef677c6614ff068641a",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "61adedf3e3f1d3f032c5a6a299978d91eff6d555",
|
||
"lessThan": "2179d96ec702cc33ead02a9ce40ece599b8538c5",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "61adedf3e3f1d3f032c5a6a299978d91eff6d555",
|
||
"lessThan": "a915379594f1e045421635c6316d8f3ffa018c58",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "61adedf3e3f1d3f032c5a6a299978d91eff6d555",
|
||
"lessThan": "67a9c94317402b826fc3db32afc8f39336803d97",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"include/net/dst_metadata.h"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "4.3",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "4.3",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.4.277",
|
||
"lessThanOrEqual": "4.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.9.277",
|
||
"lessThanOrEqual": "4.9.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.14.241",
|
||
"lessThanOrEqual": "4.14.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.19.199",
|
||
"lessThanOrEqual": "4.19.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.135",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.53",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.13.5",
|
||
"lessThanOrEqual": "5.13.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.14",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.3",
|
||
"versionEndExcluding": "4.4.277"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.3",
|
||
"versionEndExcluding": "4.9.277"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.3",
|
||
"versionEndExcluding": "4.14.241"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.3",
|
||
"versionEndExcluding": "4.19.199"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.3",
|
||
"versionEndExcluding": "5.4.135"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.3",
|
||
"versionEndExcluding": "5.10.53"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.3",
|
||
"versionEndExcluding": "5.13.5"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.3",
|
||
"versionEndExcluding": "5.14"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e7f3c9df40515a6c6b46f36c4c94cf48a043f887"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/b61d327cd3cc5ea591f3bf751dd11e034f388bb5"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/8bb1589c89e61e3b182dd546f1021928ebb5c2a6"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/8aa13a86964cdec4fd969ef677c6614ff068641a"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/2179d96ec702cc33ead02a9ce40ece599b8538c5"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/a915379594f1e045421635c6316d8f3ffa018c58"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/67a9c94317402b826fc3db32afc8f39336803d97"
|
||
}
|
||
],
|
||
"title": "net: validate lwtstate->data before returning from skb_tunnel_info()",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"title": "CISA ADP Vulnrichment",
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2021-47309",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2024-05-23T19:12:00.559990Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-06-04T17:14:34.709Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-04T05:32:08.596Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e7f3c9df40515a6c6b46f36c4c94cf48a043f887",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/b61d327cd3cc5ea591f3bf751dd11e034f388bb5",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/8bb1589c89e61e3b182dd546f1021928ebb5c2a6",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/8aa13a86964cdec4fd969ef677c6614ff068641a",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/2179d96ec702cc33ead02a9ce40ece599b8538c5",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/a915379594f1e045421635c6316d8f3ffa018c58",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/67a9c94317402b826fc3db32afc8f39336803d97",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |