SECUFOCUSNOW
Home›CVE index›CVE-2021-47309
Review reviewHigh

CVE-2021-47309

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: net: validate lwtstate->data before returning from skb_tunnel_info() skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible. So skb_tunnel_info() should validate before returning that pointer. Splat looks like: BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811 CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #119...

CVSS
7.1
EPSS
0.25%
16.1% percentile
CISA KEV
Not listed
Published
2024.05.22
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.25%
Technical severityCVSS 7.1

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: validate lwtstate->data before returning from skb_tunnel_info() skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible. So skb_tunnel_info() should validate before returning that pointer. Splat looks like: BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811 CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #119...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < e7f3c9df40515a6c6b46f36c4c94cf48a043f887, >= 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < b61d327cd3cc5ea591f3bf751dd11e034f388bb5, >= 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < 83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d, >= 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < 8bb1589c89e61e3b182dd546f1021928ebb5c2a6, >= 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < 8aa13a86964cdec4fd969ef677c6614ff068641a, >= 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < 2179d96ec702cc33ead02a9ce40ece599b8538c5, >= 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < a915379594f1e045421635c6316d8f3ffa018c58, >= 61adedf3e3f1d3f032c5a6a299978d91eff6d555 < 67a9c94317402b826fc3db32afc8f39336803d97, >= 4.3, >= 4.3 < 4.4.277, >= 4.5 < 4.9.277, >= 4.10 < 4.14.241, >= 4.15 < 4.19.199, >= 4.20 < 5.4.135, >= 5.5 < 5.10.53, >= 5.11 < 5.13.5, 5.14
Fixed versions
4.4.277, 4.9.277, 4.14.241, 4.19.199, 5.4.135, 5.10.53, 5.13.5

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE
CWE-125