CVE-2021-47103

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearly documenting it. And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv() are not following standard RCU rules. [a] dst_release(dst); [b] sk->sk_rx_dst = NULL; They look wrong because a delete operation of RCU protected pointer is supposed to clear the pointer before the call_rcu()/synchronize_rcu() guarding actual memory freeing. In...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 41063e9dd11956f2d285e12e4342e1d232ba0ea2 < 68c34ce11ef23328692aa35fa6aaafdd75913100, >= 41063e9dd11956f2d285e12e4342e1d232ba0ea2 < 92e6e36ecd16808866ac6172b9491b5097cde449, >= 41063e9dd11956f2d285e12e4342e1d232ba0ea2 < 75a578000ae5e511e5d0e8433c94a14d9c99c412, >= 41063e9dd11956f2d285e12e4342e1d232ba0ea2 < c3bb4a7e8cbc984e1cdac0fe6af60e880214ed6e, >= 41063e9dd11956f2d285e12e4342e1d232ba0ea2 < f039b43cbaea5e0700980c2f0052da05a70782e0, >= 41063e9dd11956f2d285e12e4342e1d232ba0ea2 < 0249a4b8a554f2eb6a27b62516fa50168584faa4, >= 41063e9dd11956f2d285e12e4342e1d232ba0ea2 < 8f905c0e7354ef261360fb7535ea079b1082c105, >= 3.6, >= 3.6 < 4.9.331, >= 4.10 < 4.14.296, >= 4.15 < 4.19.262, >= 4.20 < 5.4.220, >= 5.5 < 5.10.150, >= 5.11 < 5.15.12, 5.16

Fixed versions

4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.12

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416