CVE-2021-47109
published 2024-03-15CVE-2021-47109: In the Linux kernel, the following vulnerability has been resolved: neighbour: allow NUD_NOARP entries to be forced GCed IFF_POINTOPOINT interfaces use…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.68%
49.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
neighbour: allow NUD_NOARP entries to be forced GCed
IFF_POINTOPOINT interfaces use NUD_NOARP entries for IPv6. It's possible to
fill up the neighbour table with enough entries that it will overflow for
valid connections after that.
This behaviour is more prevalent after commit 58956317c8de ("neighbor:
Improve garbage collection") is applied, as it prevents removal from
entries that are not NUD_FAILED, unless they are more than 5s old.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.46-1 (bookworm) | linux 5.10.46-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 58956317c8de52009d1a38a721474c24aef74fe7 < d99029e6aab62aef0a0251588b2867e77e83b137 | d99029e6aab62aef0a0251588b2867e77e83b137 |
| linux | linux | >= 58956317c8de52009d1a38a721474c24aef74fe7 < d17d47da59f726dc4c87caebda3a50333d7e2fd3 | d17d47da59f726dc4c87caebda3a50333d7e2fd3 |
| linux | linux | >= 58956317c8de52009d1a38a721474c24aef74fe7 < ddf088d7aaaaacfc836104f2e632b29b1d383cfc | ddf088d7aaaaacfc836104f2e632b29b1d383cfc |
| linux | linux | >= 58956317c8de52009d1a38a721474c24aef74fe7 < 7a6b1ab7475fd6478eeaf5c9d1163e7a18125c8f | 7a6b1ab7475fd6478eeaf5c9d1163e7a18125c8f |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 5.0 < 5.4.125 | 5.4.125 |
| linux | linux_kernel | >= 5.11 < 5.12.10 | 5.12.10 |
| linux | linux_kernel | >= 5.5 < 5.10.43 | 5.10.43 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 5.4.124/5.10.42/5.12.9 Neighbour resource consumption (Nessus ID 276342)
vuldb·2026-08-04·CVSS 5.5
CVE-2021-47109 [MEDIUM] Linux Kernel up to 5.4.124/5.10.42/5.12.9 Neighbour resource consumption (Nessus ID 276342)
A vulnerability was found in Linux Kernel up to 5.4.124/5.10.42/5.12.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Neighbour Handler. This manipulation causes resource consumption.
This vulnerability is registered as CVE-2021-47109. The attack requires access to the local network. No exploit is available.
Upgrading the affected component is advised.
GHSA
GHSA-4jvh-cf85-8374: In the Linux kernel, the following vulnerability has been resolved:
neighbour: allow NUD_NOARP entries to be forced GCed
IFF_POINTOPOINT interfaces
ghsa_unreviewed·2024-03-15
CVE-2021-47109 [MEDIUM] CWE-190 GHSA-4jvh-cf85-8374: In the Linux kernel, the following vulnerability has been resolved:
neighbour: allow NUD_NOARP entries to be forced GCed
IFF_POINTOPOINT interfaces
In the Linux kernel, the following vulnerability has been resolved:
neighbour: allow NUD_NOARP entries to be forced GCed
IFF_POINTOPOINT interfaces use NUD_NOARP entries for IPv6. It's possible to
fill up the neighbour table with enough entries that it will overflow for
valid connections after that.
This behaviour is more prevalent after commit 58956317c8de ("neighbor:
Improve garbage collection") is applied, as it prevents removal from
entries that are not NUD_FAILED, unless they are more than 5s old.
OSV
CVE-2021-47109: In the Linux kernel, the following vulnerability has been resolved: neighbour: allow NUD_NOARP entries to be forced GCed IFF_POINTOPOINT interfaces us
osv·2024-03-15·CVSS 5.5
CVE-2021-47109 [MEDIUM] CVE-2021-47109: In the Linux kernel, the following vulnerability has been resolved: neighbour: allow NUD_NOARP entries to be forced GCed IFF_POINTOPOINT interfaces us
In the Linux kernel, the following vulnerability has been resolved: neighbour: allow NUD_NOARP entries to be forced GCed IFF_POINTOPOINT interfaces use NUD_NOARP entries for IPv6. It's possible to fill up the neighbour table with enough entries that it will overflow for valid connections after that. This behaviour is more prevalent after commit 58956317c8de ("neighbor: Improve garbage collection") is applied, as it prevents removal from entries that are not NUD_FAILED, unless they are more than 5s old.
Red Hat
kernel: neighbour: allow NUD_NOARP entries to be forced GCed
vendor_redhat·2024-03-15·CVSS 5.5
CVE-2021-47109 [MEDIUM] CWE-121 kernel: neighbour: allow NUD_NOARP entries to be forced GCed
kernel: neighbour: allow NUD_NOARP entries to be forced GCed
In the Linux kernel, the following vulnerability has been resolved:
neighbour: allow NUD_NOARP entries to be forced GCed
IFF_POINTOPOINT interfaces use NUD_NOARP entries for IPv6. It's possible to
fill up the neighbour table with enough entries that it will overflow for
valid connections after that.
This behaviour is more prevalent after commit 58956317c8de ("neighbor:
Improve garbage collection") is applied, as it prevents removal from
entries that are not NUD_FAILED, unless they are more than 5s old.
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel-rt (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel (Re
Debian
CVE-2021-47109: linux - In the Linux kernel, the following vulnerability has been resolved: neighbour: ...
vendor_debian·2021·CVSS 5.5
CVE-2021-47109 [MEDIUM] CVE-2021-47109: linux - In the Linux kernel, the following vulnerability has been resolved: neighbour: ...
In the Linux kernel, the following vulnerability has been resolved: neighbour: allow NUD_NOARP entries to be forced GCed IFF_POINTOPOINT interfaces use NUD_NOARP entries for IPv6. It's possible to fill up the neighbour table with enough entries that it will overflow for valid connections after that. This behaviour is more prevalent after commit 58956317c8de ("neighbor: Improve garbage collection") is applied, as it prevents removal from entries that are not NUD_FAILED, unless they are more than 5s old.
Scope: local
bookworm: resolved (fixed in 5.10.46-1)
bullseye: resolved (fixed in 5.10.46-1)
forky: resolved (fixed in 5.10.46-1)
sid: resolved (fixed in 5.10.46-1)
trixie: resolved (fixed in 5.10.46-1)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/7a6b1ab7475fd6478eeaf5c9d1163e7a18125c8fhttps://git.kernel.org/stable/c/d17d47da59f726dc4c87caebda3a50333d7e2fd3https://git.kernel.org/stable/c/d99029e6aab62aef0a0251588b2867e77e83b137https://git.kernel.org/stable/c/ddf088d7aaaaacfc836104f2e632b29b1d383cfchttps://git.kernel.org/stable/c/7a6b1ab7475fd6478eeaf5c9d1163e7a18125c8fhttps://git.kernel.org/stable/c/d17d47da59f726dc4c87caebda3a50333d7e2fd3https://git.kernel.org/stable/c/d99029e6aab62aef0a0251588b2867e77e83b137https://git.kernel.org/stable/c/ddf088d7aaaaacfc836104f2e632b29b1d383cfc
2024-03-15
Published