CVE-2021-47162
Linux Kernel Tipc fragments use after free vulnerability.
Description
In the Linux kernel, the following vulnerability has been resolved: tipc: skb_linearize the head skb when reassembling msgs It's not a good idea to append the frag skb to a skb's frag_list if the frag_list already has skbs from elsewhere, such as this skb was created by pskb_copy() where the frag_list was cloned (all the skbs in it were skb_get'ed) and shared by multiple skbs. However, the new appended frag skb should have been only seen by the current skb. Otherwise, it will cause use after free crashes as this appended frag skb are seen by multiple skbs but it only got skb_get called once. The same thing happens with a skb updated by pskb_may_pull() with a skb_cloned skb. Li Shuang has reported quite a few crashes caused by this when doing testing over macvlan devices: [] kernel BUG at net/core/skbuff.c:1970! [] Call Trace: [] skb_clone+0x4d/0xb0 [] macvlan_broadcast+0xd8/0x160 [macvlan] [] macvlan_process_broadcast+0x148/0x150 [macvlan] [] process_one_work+0x1a7/0x360 [] worker_thread+0x30/0x390 [] kernel BUG at mm/usercopy.c:102! [] Call Trace: [] __check_heap_object+0xd3/0x100 [] __check_object_size+0xff/0x16b [] simple_copy_to_iter+0x1c/0x30 [] __skb_datagram_iter+0x7d/0x310 [] __skb_datagram_iter+0x2a5/0x310 [] skb_copy_datagram_iter+0x3b/0x90 [] tipc_recvmsg+0x14a/0x3a0 [tipc] [] ____sys_recvmsg+0x91/0x150 [] ___sys_recvmsg+0x7b/0xc0 [] kernel BUG at mm/slub.c:305! [] Call Trace: [] <IRQ> [] kmem_cache_free+0x3ff/0x400 [] __netif_receive_skb_core+0x12c/0xc40 [] ? kmem_cache_alloc+0x12e/0x270 [] netif_receive_skb_internal+0x3d/0xb0 [] ? get_rx_page_info+0x8e/0xa0 [be2net] [] be_poll+0x6ef/0xd00 [be2net] [] ? irq_exit+0x4f/0x100 [] net_rx_action+0x149/0x3b0 ... This patch is to fix it by linearizing the head skb if it has frag_list set in tipc_buf_append(). Note that we choose to do this before calling skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can not just drop the frag_list either as the early time.
INFO
Published Date :
March 25, 2024, 10:15 a.m.
Last Modified :
March 13, 2025, 9:23 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to a patched version.
- Reboot the system after the kernel update.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2021-47162.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2021-47162 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2021-47162
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2021-47162 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2021-47162 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Mar. 13, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 from (excluding) 5.12.9 *cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 from (excluding) 5.10.42 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 from (excluding) 5.4.124 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.3 from (excluding) 4.4.271 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.5 from (excluding) 4.9.271 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10 from (excluding) 4.14.235 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 from (excluding) 4.19.193 Added Reference Type CVE: https://git.kernel.org/stable/c/436d650d374329a591c30339a91fa5078052ed1e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/436d650d374329a591c30339a91fa5078052ed1e Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/4b1761898861117c97066aea6c58f68a7787f0bf Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4b1761898861117c97066aea6c58f68a7787f0bf Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/5489f30bb78ff0dafb4229a69632afc2ba20765c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5489f30bb78ff0dafb4229a69632afc2ba20765c Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/64d17ec9f1ded042c4b188d15734f33486ed9966 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/64d17ec9f1ded042c4b188d15734f33486ed9966 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/6da24cfc83ba4f97ea44fc7ae9999a006101755c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6da24cfc83ba4f97ea44fc7ae9999a006101755c Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/ace300eecbccaa698e2b472843c74a5f33f7dce8 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ace300eecbccaa698e2b472843c74a5f33f7dce8 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/b2c8d28c34b3070407cb1741f9ba3f15d0284b8b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b2c8d28c34b3070407cb1741f9ba3f15d0284b8b Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/b7df21cf1b79ab7026f545e7bf837bd5750ac026 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b7df21cf1b79ab7026f545e7bf837bd5750ac026 Types: Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/436d650d374329a591c30339a91fa5078052ed1e Added Reference https://git.kernel.org/stable/c/4b1761898861117c97066aea6c58f68a7787f0bf Added Reference https://git.kernel.org/stable/c/5489f30bb78ff0dafb4229a69632afc2ba20765c Added Reference https://git.kernel.org/stable/c/64d17ec9f1ded042c4b188d15734f33486ed9966 Added Reference https://git.kernel.org/stable/c/6da24cfc83ba4f97ea44fc7ae9999a006101755c Added Reference https://git.kernel.org/stable/c/ace300eecbccaa698e2b472843c74a5f33f7dce8 Added Reference https://git.kernel.org/stable/c/b2c8d28c34b3070407cb1741f9ba3f15d0284b8b Added Reference https://git.kernel.org/stable/c/b7df21cf1b79ab7026f545e7bf837bd5750ac026 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 28, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 25, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: tipc: skb_linearize the head skb when reassembling msgs It's not a good idea to append the frag skb to a skb's frag_list if the frag_list already has skbs from elsewhere, such as this skb was created by pskb_copy() where the frag_list was cloned (all the skbs in it were skb_get'ed) and shared by multiple skbs. However, the new appended frag skb should have been only seen by the current skb. Otherwise, it will cause use after free crashes as this appended frag skb are seen by multiple skbs but it only got skb_get called once. The same thing happens with a skb updated by pskb_may_pull() with a skb_cloned skb. Li Shuang has reported quite a few crashes caused by this when doing testing over macvlan devices: [] kernel BUG at net/core/skbuff.c:1970! [] Call Trace: [] skb_clone+0x4d/0xb0 [] macvlan_broadcast+0xd8/0x160 [macvlan] [] macvlan_process_broadcast+0x148/0x150 [macvlan] [] process_one_work+0x1a7/0x360 [] worker_thread+0x30/0x390 [] kernel BUG at mm/usercopy.c:102! [] Call Trace: [] __check_heap_object+0xd3/0x100 [] __check_object_size+0xff/0x16b [] simple_copy_to_iter+0x1c/0x30 [] __skb_datagram_iter+0x7d/0x310 [] __skb_datagram_iter+0x2a5/0x310 [] skb_copy_datagram_iter+0x3b/0x90 [] tipc_recvmsg+0x14a/0x3a0 [tipc] [] ____sys_recvmsg+0x91/0x150 [] ___sys_recvmsg+0x7b/0xc0 [] kernel BUG at mm/slub.c:305! [] Call Trace: [] <IRQ> [] kmem_cache_free+0x3ff/0x400 [] __netif_receive_skb_core+0x12c/0xc40 [] ? kmem_cache_alloc+0x12e/0x270 [] netif_receive_skb_internal+0x3d/0xb0 [] ? get_rx_page_info+0x8e/0xa0 [be2net] [] be_poll+0x6ef/0xd00 [be2net] [] ? irq_exit+0x4f/0x100 [] net_rx_action+0x149/0x3b0 ... This patch is to fix it by linearizing the head skb if it has frag_list set in tipc_buf_append(). Note that we choose to do this before calling skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can not just drop the frag_list either as the early time. Added Reference kernel.org https://git.kernel.org/stable/c/b2c8d28c34b3070407cb1741f9ba3f15d0284b8b [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/5489f30bb78ff0dafb4229a69632afc2ba20765c [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/436d650d374329a591c30339a91fa5078052ed1e [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4b1761898861117c97066aea6c58f68a7787f0bf [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/64d17ec9f1ded042c4b188d15734f33486ed9966 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/6da24cfc83ba4f97ea44fc7ae9999a006101755c [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/ace300eecbccaa698e2b472843c74a5f33f7dce8 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/b7df21cf1b79ab7026f545e7bf837bd5750ac026 [No types assigned]