CVE-2021-47291 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions While running the self-tests on a KASAN enabled kernel, I observed a slab-out-of-bounds splat very similar to the one reported in commit 821bbf79fe46 ("ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions"). We additionally need to take care of fib6_metrics initialization failure when the caller provides an nh. The fix is similar, explicitly free the route instead of calling fib6_info_release on a half-initialized object.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/115784bcccf135c3a3548098153413d76f16aae0
https://git.kernel.org/stable/c/830251361425c5be044db4d826aaf304ea3d14c6
https://git.kernel.org/stable/c/8fb4792f091e608a0a1d353dfdf07ef55a719db5
https://git.kernel.org/stable/c/ce8fafb68051fba52546f8bbe8621f7641683680
https://lore.kernel.org/linux-cve-announce/2024052123-CVE-2021-47291-8eb9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2021-47291
https://www.cve.org/CVERecord?id=CVE-2021-47291

History

Tue, 05 Nov 2024 08:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-21T14:35:16.071Z

Updated: 2024-11-04T12:03:05.568Z

Reserved: 2024-05-21T13:27:52.130Z

Link: CVE-2021-47291

Vulnrichment

Updated: 2024-08-04T05:32:08.000Z

NVD

Status : Awaiting Analysis

Published: 2024-05-21T15:15:17.100

Modified: 2024-05-21T16:54:26.047

Link: CVE-2021-47291

Redhat

Severity : Low

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2021-47291 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47291", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T13:27:52.130Z", "datePublished": "2024-05-21T14:35:16.071Z", "dateUpdated": "2024-11-04T12:03:05.568Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:03:05.568Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions\n\nWhile running the self-tests on a KASAN enabled kernel, I observed a\nslab-out-of-bounds splat very similar to the one reported in\ncommit 821bbf79fe46 (\"ipv6: Fix KASAN: slab-out-of-bounds Read in\n fib6_nh_flush_exceptions\").\n\nWe additionally need to take care of fib6_metrics initialization\nfailure when the caller provides an nh.\n\nThe fix is similar, explicitly free the route instead of calling\nfib6_info_release on a half-initialized object."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/route.c"], "versions": [{"version": "f88d8ea67fbd", "lessThan": "830251361425", "status": "affected", "versionType": "git"}, {"version": "f88d8ea67fbd", "lessThan": "ce8fafb68051", "status": "affected", "versionType": "git"}, {"version": "f88d8ea67fbd", "lessThan": "115784bcccf1", "status": "affected", "versionType": "git"}, {"version": "f88d8ea67fbd", "lessThan": "8fb4792f091e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/route.c"], "versions": [{"version": "5.3", "status": "affected"}, {"version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.136", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.54", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13.6", "lessThanOrEqual": "5.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/830251361425c5be044db4d826aaf304ea3d14c6"}, {"url": "https://git.kernel.org/stable/c/ce8fafb68051fba52546f8bbe8621f7641683680"}, {"url": "https://git.kernel.org/stable/c/115784bcccf135c3a3548098153413d76f16aae0"}, {"url": "https://git.kernel.org/stable/c/8fb4792f091e608a0a1d353dfdf07ef55a719db5"}], "title": "ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.000Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/830251361425c5be044db4d826aaf304ea3d14c6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ce8fafb68051fba52546f8bbe8621f7641683680", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/115784bcccf135c3a3548098153413d76f16aae0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8fb4792f091e608a0a1d353dfdf07ef55a719db5", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-19T18:51:27.837598Z", "id": "CVE-2021-47291", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-19T18:52:14.586Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/830251361425c5be044db4d826aaf304ea3d14c6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ce8fafb68051fba52546f8bbe8621f7641683680", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/115784bcccf135c3a3548098153413d76f16aae0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8fb4792f091e608a0a1d353dfdf07ef55a719db5", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.000Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47291", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-19T18:51:27.837598Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-19T18:52:11.686Z"}}], "cna": {"title": "ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f88d8ea67fbd", "lessThan": "830251361425", "versionType": "git"}, {"status": "affected", "version": "f88d8ea67fbd", "lessThan": "ce8fafb68051", "versionType": "git"}, {"status": "affected", "version": "f88d8ea67fbd", "lessThan": "115784bcccf1", "versionType": "git"}, {"status": "affected", "version": "f88d8ea67fbd", "lessThan": "8fb4792f091e", "versionType": "git"}], "programFiles": ["net/ipv6/route.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"status": "unaffected", "version": "0", "lessThan": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.136", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.54", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.13.6", "versionType": "semver", "lessThanOrEqual": "5.13.*"}, {"status": "unaffected", "version": "5.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv6/route.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/830251361425c5be044db4d826aaf304ea3d14c6"}, {"url": "https://git.kernel.org/stable/c/ce8fafb68051fba52546f8bbe8621f7641683680"}, {"url": "https://git.kernel.org/stable/c/115784bcccf135c3a3548098153413d76f16aae0"}, {"url": "https://git.kernel.org/stable/c/8fb4792f091e608a0a1d353dfdf07ef55a719db5"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions\n\nWhile running the self-tests on a KASAN enabled kernel, I observed a\nslab-out-of-bounds splat very similar to the one reported in\ncommit 821bbf79fe46 (\"ipv6: Fix KASAN: slab-out-of-bounds Read in\n fib6_nh_flush_exceptions\").\n\nWe additionally need to take care of fib6_metrics initialization\nfailure when the caller provides an nh.\n\nThe fix is similar, explicitly free the route instead of calling\nfib6_info_release on a half-initialized object."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:03:05.568Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47291", "state": "PUBLISHED", "dateUpdated": "2024-11-04T12:03:05.568Z", "dateReserved": "2024-05-21T13:27:52.130Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-21T14:35:16.071Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions", "id": "2282506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282506"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions\nWhile running the self-tests on a KASAN enabled kernel, I observed a\nslab-out-of-bounds splat very similar to the one reported in\ncommit 821bbf79fe46 (\"ipv6: Fix KASAN: slab-out-of-bounds Read in\nfib6_nh_flush_exceptions\").\nWe additionally need to take care of fib6_metrics initialization\nfailure when the caller provides an nh.\nThe fix is similar, explicitly free the route instead of calling\nfib6_info_release on a half-initialized object."], "name": "CVE-2021-47291", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47291\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47291\nhttps://lore.kernel.org/linux-cve-announce/2024052123-CVE-2021-47291-8eb9@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 5.4.136, kernel 5.10.54, kernel 5.13.6, kernel 5.14"}