CVE-2021-47224

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47224", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-04-10T18:59:19.529Z", "datePublished": "2024-05-21T14:19:29.542Z", "dateUpdated": "2026-08-05T08:46:48.857Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:48.857Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ll_temac: Make sure to free skb when it is completely used\n\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\nefficient way to free the skb buffer when the frame has been transmitted.\nBut in order to avoid freeing the skb while there are still fragments from\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\nfirst.\n\nWithout this, we are doing use-after-free on the DMA side, when the first\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\nremaining BDs are still being processed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in the ll_temac TX path (temac_start_xmit \u2192 TX IRQ \u2192 temac_start_xmit_done), reached when a local process transmits multi-fragment skbs on a Xilinx LL TEMAC interface with NETIF_F_SG; it is not triggered by parsing remotely injected RX frames.\nAC:L - Any multi-fragment transmit (nr_frags > 0) deterministically stores the skb on the first BD and frees it in xmit_done before remaining fragment BDs are unmapped, so an attacker who sends large/SG traffic reliably hits the DMA use-after-free with no uncontrollable race.\nPR:L - An unprivileged local user can open sockets and send traffic out an already-up TEMAC interface without CAP_NET_ADMIN or init-namespace root, matching other NIC TX-path UAF scores.\nUI:N - Exploitation requires only attacker-generated transmit traffic; no separate victim action such as mounting a filesystem or opening a crafted file is needed.\nS:U - Impact stays within the host kernel's networking/DMA authority (premature skb free and DMA-after-free of TX fragments) and does not cross a VM, IOMMU isolation, or other security boundary.\nC:H - Freeing the skb while fragment pages remain DMA-mapped lets the engine read recycled page contents and can disclose them on the wire; per UAF guidance this is High confidentiality impact.\nI:H - Premature free/unmap of an in-flight multi-BD skb is a reclaimable DMA/heap use-after-free under attacker-driven TX; per UAF guidance this class enables heap corruption and control-flow hijack primitives.\nA:H - DMA-after-free of still-mapped TX fragments can IOMMU-fault or oops the kernel, and any use-after-free scores Availability High even when not fully turned into code execution."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/xilinx/ll_temac_main.c"], "versions": [{"version": "92744989533cbe85e8057935d230e128810168ce", "lessThan": "6d120ab4dc39a543c6b63361e1d0541c382900a3", "status": "affected", "versionType": "git"}, {"version": "92744989533cbe85e8057935d230e128810168ce", "lessThan": "019ab7d044d0ebf97e1236bb8935b7809be92358", "status": "affected", "versionType": "git"}, {"version": "92744989533cbe85e8057935d230e128810168ce", "lessThan": "e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b", "status": "affected", "versionType": "git"}, {"version": "92744989533cbe85e8057935d230e128810168ce", "lessThan": "6aa32217a9a446275440ee8724b1ecaf1838df47", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/xilinx/ll_temac_main.c"], "versions": [{"version": "2.6.31", "status": "affected"}, {"version": "0", "lessThan": "2.6.31", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.128", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.46", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.13", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.4.128"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.10.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.12.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3"}, {"url": "https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358"}, {"url": "https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b"}, {"url": "https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47"}], "title": "net: ll_temac: Make sure to free skb when it is completely used", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-31T18:48:29.010008Z", "id": "CVE-2021-47224", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T20:41:06.725Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:07.412Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:07.412Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-47224", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-31T18:48:29.010008Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-31T18:48:32.403Z"}}], "cna": {"title": "net: ll_temac: Make sure to free skb when it is completely used", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in the ll_temac TX path (temac_start_xmit \u2192 TX IRQ \u2192 temac_start_xmit_done), reached when a local process transmits multi-fragment skbs on a Xilinx LL TEMAC interface with NETIF_F_SG; it is not triggered by parsing remotely injected RX frames.\nAC:L - Any multi-fragment transmit (nr_frags > 0) deterministically stores the skb on the first BD and frees it in xmit_done before remaining fragment BDs are unmapped, so an attacker who sends large/SG traffic reliably hits the DMA use-after-free with no uncontrollable race.\nPR:L - An unprivileged local user can open sockets and send traffic out an already-up TEMAC interface without CAP_NET_ADMIN or init-namespace root, matching other NIC TX-path UAF scores.\nUI:N - Exploitation requires only attacker-generated transmit traffic; no separate victim action such as mounting a filesystem or opening a crafted file is needed.\nS:U - Impact stays within the host kernel's networking/DMA authority (premature skb free and DMA-after-free of TX fragments) and does not cross a VM, IOMMU isolation, or other security boundary.\nC:H - Freeing the skb while fragment pages remain DMA-mapped lets the engine read recycled page contents and can disclose them on the wire; per UAF guidance this is High confidentiality impact.\nI:H - Premature free/unmap of an in-flight multi-BD skb is a reclaimable DMA/heap use-after-free under attacker-driven TX; per UAF guidance this class enables heap corruption and control-flow hijack primitives.\nA:H - DMA-after-free of still-mapped TX fragments can IOMMU-fault or oops the kernel, and any use-after-free scores Availability High even when not fully turned into code execution."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "92744989533cbe85e8057935d230e128810168ce", "lessThan": "6d120ab4dc39a543c6b63361e1d0541c382900a3", "versionType": "git"}, {"status": "affected", "version": "92744989533cbe85e8057935d230e128810168ce", "lessThan": "019ab7d044d0ebf97e1236bb8935b7809be92358", "versionType": "git"}, {"status": "affected", "version": "92744989533cbe85e8057935d230e128810168ce", "lessThan": "e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b", "versionType": "git"}, {"status": "affected", "version": "92744989533cbe85e8057935d230e128810168ce", "lessThan": "6aa32217a9a446275440ee8724b1ecaf1838df47", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/xilinx/ll_temac_main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.31", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.128", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.46", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.12.13", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/xilinx/ll_temac_main.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3"}, {"url": "https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358"}, {"url": "https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b"}, {"url": "https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ll_temac: Make sure to free skb when it is completely used\n\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\nefficient way to free the skb buffer when the frame has been transmitted.\nBut in order to avoid freeing the skb while there are still fragments from\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\nfirst.\n\nWithout this, we are doing use-after-free on the DMA side, when the first\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\nremaining BDs are still being processed."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.128", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.46", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.12.13", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.13", "versionStartIncluding": "2.6.31"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:48.857Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47224", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:46:48.857Z", "dateReserved": "2024-04-10T18:59:19.529Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-21T14:19:29.542Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/xilinx/ll_temac_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6d120ab4dc39a543c6b63361e1d0541c382900a3", "status": "affected", "version": "92744989533cbe85e8057935d230e128810168ce", "versionType": "git"}, {"lessThan": "019ab7d044d0ebf97e1236bb8935b7809be92358", "status": "affected", "version": "92744989533cbe85e8057935d230e128810168ce", "versionType": "git"}, {"lessThan": "e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b", "status": "affected", "version": "92744989533cbe85e8057935d230e128810168ce", "versionType": "git"}, {"lessThan": "6aa32217a9a446275440ee8724b1ecaf1838df47", "status": "affected", "version": "92744989533cbe85e8057935d230e128810168ce", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/xilinx/ll_temac_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"lessThan": "2.6.31", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.128", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.46", "versionType": "semver"}, {"lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3F3CD510-C528-4ECA-AD21-A4F1A661CA40", "versionEndExcluding": "5.4.128", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "59455D13-A902-42E1-97F7-5ED579777193", "versionEndExcluding": "5.10.46", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7806E7E5-6D4F-4E18-81C1-79B3C60EE855", "versionEndExcluding": "5.12.13", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*", "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*", "matchCriteriaId": "1ECD33F5-85BE-430B-8F86-8D7BD560311D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*", "matchCriteriaId": "CF351855-2437-4CF5-AD7C-BDFA51F27683", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*", "matchCriteriaId": "25A855BA-2118-44F2-90EF-EBBB12AF51EF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ll_temac: Make sure to free skb when it is completely used\n\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\nefficient way to free the skb buffer when the frame has been transmitted.\nBut in order to avoid freeing the skb while there are still fragments from\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\nfirst.\n\nWithout this, we are doing use-after-free on the DMA side, when the first\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\nremaining BDs are still being processed."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: net:ll_temac: Aseg\u00farate de liberar skb cuando est\u00e9 completamente utilizado. Con el puntero skb acoplado en la BD TX, tenemos una forma sencilla y eficaz de liberar el buffer skb. cuando la trama ha sido transmitida. Pero para evitar liberar el skb mientras todav\u00eda hay fragmentos del skb en uso, debemos aprovechar el BD TX del skb, no el primero. Sin esto, estamos haciendo use after free en el lado DMA, cuando el primer BD de un paquete BD de transmisi\u00f3n m\u00faltiple se considera completado en xmit_done y los BD restantes todav\u00eda se est\u00e1n procesando."}], "id": "CVE-2021-47224", "lastModified": "2026-08-04T10:16:53.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47224", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-31T18:48:29.010008Z", "version": "2.0.3"}}]}, "published": "2024-05-21T15:15:11.687", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: ll_temac: Make sure to free skb when it is completely used", "id": "2282593", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282593"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: ll_temac: Make sure to free skb when it is completely used\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\nefficient way to free the skb buffer when the frame has been transmitted.\nBut in order to avoid freeing the skb while there are still fragments from\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\nfirst.\nWithout this, we are doing use-after-free on the DMA side, when the first\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\nremaining BDs are still being processed.", "A vulnerability was found in the Linux kernel's ll_temac driver, where the skb (socket buffer) may be improperly freed after use. This can lead to a use-after-free issue, as fragments of the skb can still be in use while attempting to free it, causing instability in the system during data transmission."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2021-47224", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47224\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47224\nhttps://lore.kernel.org/linux-cve-announce/2024052136-CVE-2021-47224-8135@gregkh/T"], "statement": "None of the products shipped by Red Hat are affected by this vulnerability.", "threat_severity": "Moderate"}

{}