CVE-2021-47301 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: igb: Fix use-after-free error during reset Cleans the next descriptor to watch (next_to_watch) when cleaning the TX ring. Failure to do so can cause invalid memory accesses. If igb_poll() runs while the controller is reset this can lead to the driver try to free a skb that was already freed. (The crash is harder to reproduce with the igb driver, but the same potential problem exists as the code is identical to igc)

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/7b292608db23ccbbfbfa50cdb155d01725d7a52e
https://git.kernel.org/stable/c/88e0720133d42d34851c8721cf5f289a50a8710f
https://git.kernel.org/stable/c/8e24c12f2ff6d32fd9f057382f08e748ec97194c
https://git.kernel.org/stable/c/d3ccb18ed5ac3283c7b31ecc685b499e580d5492
https://git.kernel.org/stable/c/d7367f781e5a9ca5df9082b15b272b55e76931f8
https://git.kernel.org/stable/c/f153664d8e70c11d0371341613651e1130e20240
https://lore.kernel.org/linux-cve-announce/2024052126-CVE-2021-47301-13b4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2021-47301
https://www.cve.org/CVERecord?id=CVE-2021-47301

History

Wed, 11 Sep 2024 18:30:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-21T14:35:22.705Z

Updated: 2024-11-04T12:03:17.182Z

Reserved: 2024-05-21T13:27:52.132Z

Link: CVE-2021-47301

Vulnrichment

Updated: 2024-08-04T05:32:08.341Z

NVD

Status : Awaiting Analysis

Published: 2024-05-21T15:15:17.890

Modified: 2024-05-21T16:54:26.047

Link: CVE-2021-47301

Redhat

Severity : Moderate

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2021-47301 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47301", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T13:27:52.132Z", "datePublished": "2024-05-21T14:35:22.705Z", "dateUpdated": "2024-11-04T12:03:17.182Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:03:17.182Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix use-after-free error during reset\n\nCleans the next descriptor to watch (next_to_watch) when cleaning the\nTX ring.\n\nFailure to do so can cause invalid memory accesses. If igb_poll() runs\nwhile the controller is reset this can lead to the driver try to free\na skb that was already freed.\n\n(The crash is harder to reproduce with the igb driver, but the same\npotential problem exists as the code is identical to igc)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/igb/igb_main.c"], "versions": [{"version": "7cc6fd4c60f2", "lessThan": "d7367f781e5a", "status": "affected", "versionType": "git"}, {"version": "7cc6fd4c60f2", "lessThan": "d3ccb18ed5ac", "status": "affected", "versionType": "git"}, {"version": "7cc6fd4c60f2", "lessThan": "88e0720133d4", "status": "affected", "versionType": "git"}, {"version": "7cc6fd4c60f2", "lessThan": "f153664d8e70", "status": "affected", "versionType": "git"}, {"version": "7cc6fd4c60f2", "lessThan": "8e24c12f2ff6", "status": "affected", "versionType": "git"}, {"version": "7cc6fd4c60f2", "lessThan": "7b292608db23", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/igb/igb_main.c"], "versions": [{"version": "4.12", "status": "affected"}, {"version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.241", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.199", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.136", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.54", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13.6", "lessThanOrEqual": "5.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/d7367f781e5a9ca5df9082b15b272b55e76931f8"}, {"url": "https://git.kernel.org/stable/c/d3ccb18ed5ac3283c7b31ecc685b499e580d5492"}, {"url": "https://git.kernel.org/stable/c/88e0720133d42d34851c8721cf5f289a50a8710f"}, {"url": "https://git.kernel.org/stable/c/f153664d8e70c11d0371341613651e1130e20240"}, {"url": "https://git.kernel.org/stable/c/8e24c12f2ff6d32fd9f057382f08e748ec97194c"}, {"url": "https://git.kernel.org/stable/c/7b292608db23ccbbfbfa50cdb155d01725d7a52e"}], "title": "igb: Fix use-after-free error during reset", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.341Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/d7367f781e5a9ca5df9082b15b272b55e76931f8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d3ccb18ed5ac3283c7b31ecc685b499e580d5492", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/88e0720133d42d34851c8721cf5f289a50a8710f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f153664d8e70c11d0371341613651e1130e20240", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8e24c12f2ff6d32fd9f057382f08e748ec97194c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7b292608db23ccbbfbfa50cdb155d01725d7a52e", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47301", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:39:19.137854Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:55.043Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/d7367f781e5a9ca5df9082b15b272b55e76931f8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d3ccb18ed5ac3283c7b31ecc685b499e580d5492", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/88e0720133d42d34851c8721cf5f289a50a8710f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f153664d8e70c11d0371341613651e1130e20240", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8e24c12f2ff6d32fd9f057382f08e748ec97194c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7b292608db23ccbbfbfa50cdb155d01725d7a52e", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.341Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47301", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:39:19.137854Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:19.589Z"}}], "cna": {"title": "igb: Fix use-after-free error during reset", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7cc6fd4c60f2", "lessThan": "d7367f781e5a", "versionType": "git"}, {"status": "affected", "version": "7cc6fd4c60f2", "lessThan": "d3ccb18ed5ac", "versionType": "git"}, {"status": "affected", "version": "7cc6fd4c60f2", "lessThan": "88e0720133d4", "versionType": "git"}, {"status": "affected", "version": "7cc6fd4c60f2", "lessThan": "f153664d8e70", "versionType": "git"}, {"status": "affected", "version": "7cc6fd4c60f2", "lessThan": "8e24c12f2ff6", "versionType": "git"}, {"status": "affected", "version": "7cc6fd4c60f2", "lessThan": "7b292608db23", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/igb/igb_main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"status": "unaffected", "version": "0", "lessThan": "4.12", "versionType": "custom"}, {"status": "unaffected", "version": "4.14.241", "versionType": "custom", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.199", "versionType": "custom", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.136", "versionType": "custom", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.54", "versionType": "custom", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.13.6", "versionType": "custom", "lessThanOrEqual": "5.13.*"}, {"status": "unaffected", "version": "5.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/igb/igb_main.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d7367f781e5a9ca5df9082b15b272b55e76931f8"}, {"url": "https://git.kernel.org/stable/c/d3ccb18ed5ac3283c7b31ecc685b499e580d5492"}, {"url": "https://git.kernel.org/stable/c/88e0720133d42d34851c8721cf5f289a50a8710f"}, {"url": "https://git.kernel.org/stable/c/f153664d8e70c11d0371341613651e1130e20240"}, {"url": "https://git.kernel.org/stable/c/8e24c12f2ff6d32fd9f057382f08e748ec97194c"}, {"url": "https://git.kernel.org/stable/c/7b292608db23ccbbfbfa50cdb155d01725d7a52e"}], "x_generator": {"engine": "bippy-a5840b7849dd"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix use-after-free error during reset\n\nCleans the next descriptor to watch (next_to_watch) when cleaning the\nTX ring.\n\nFailure to do so can cause invalid memory accesses. If igb_poll() runs\nwhile the controller is reset this can lead to the driver try to free\na skb that was already freed.\n\n(The crash is harder to reproduce with the igb driver, but the same\npotential problem exists as the code is identical to igc)"}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:05:33.579Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47301", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:33:55.043Z", "dateReserved": "2024-05-21T13:27:52.132Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-21T14:35:22.705Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: igb: Fix use-after-free error during reset", "id": "2282482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282482"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nigb: Fix use-after-free error during reset\nCleans the next descriptor to watch (next_to_watch) when cleaning the\nTX ring.\nFailure to do so can cause invalid memory accesses. If igb_poll() runs\nwhile the controller is reset this can lead to the driver try to free\na skb that was already freed.\n(The crash is harder to reproduce with the igb driver, but the same\npotential problem exists as the code is identical to igc)", "A vulnerability was found in the Linux kernel's igb driver. During a reset operation, the driver could access memory that had already been freed. If the driver attempts to use this freed memory, it can lead to a system crash or instability because the memory may no longer be valid."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2021-47301", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47301\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47301\nhttps://lore.kernel.org/linux-cve-announce/2024052126-CVE-2021-47301-13b4@gregkh/T"], "statement": "This vulnerability is rated as a Moderate severity because the issue primarily impacts system stability by potentially causing a crash if the driver interacts with freed memory. It does not expose sensitive information or allow unauthorized access.", "threat_severity": "Moderate", "upstream_fix": "kernel 4.14.241, kernel 4.19.199, kernel 5.4.136, kernel 5.10.54, kernel 5.13.6, kernel 5.14"}