CVE-2021-47136
published 2024-03-25CVE-2021-47136: In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocation Function skb_ext_add() doesn't…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.54%
42.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: zero-initialize tc skb extension on allocation
Function skb_ext_add() doesn't initialize created skb extension with any
value and leaves it up to the user. However, since extension of type
TC_SKB_EXT originally contained only single value tc_skb_ext->chain its
users used to just assign the chain value without setting whole extension
memory to zero first. This assumption changed when TC_SKB_EXT extension was
extended with additional fields but not all users were updated to
initialize the new fields which leads to use of uninitialized memory
afterwards. UBSAN log:
[ 778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28
[ 778.301495] load of value 107 is not a valid value for type '_Bool'
[ 778.303215] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc7+ #2
[ 778.304933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[ 778.307901] Call Trace:
[ 778.308680]
[ 778.309358] dump_stack+0xbb/0x107
[ 778.310307] ubsan_epilogue+0x5/0x40
[ 778.311167] __ubsan_handle_load_invalid_value.cold+0x43/0x48
[ 778.312454] ? memset+0x20/0x40
[ 778.313230] ovs_flow_key_extract.cold+0xf/0x14 [openvswitch]
[ 778.314532] ovs_vport_receive+0x19e/0x2e0 [openvswitch]
[ 778.315749] ? ovs_vport_find_upcall_portid+0x330/0x330 [openvswitch]
[ 778.317188] ? create_prof_cpu_mask+0x20/0x20
[ 778.318220] ? arch_stack_walk+0x82/0xf0
[ 778.319153] ? secondary_startup_64_no_verify+0xb0/0xbb
[ 778.320399] ? stack_trace_save+0x91/0xc0
[ 778.321362] ? stack_trace_consume_entry+0x160/0x160
[ 778.322517] ? lock_release+0x52e/0x760
[ 778.323444] netdev_frame_hook+0x323/0x610 [openvswitch]
[ 778.324668] ? ovs_netdev_get_vport+0xe0/0xe0 [openvswitch]
[ 778.325950] __netif_receive_skb_core+0x771/0x2db0
[ 778.327067] ? lock_downgrade+0x6e0/0x6f0
[ 778.328021] ? lock_acquire+0x565/0x720
[ 778.328940] ? generic_xdp_tx+0x4f0/0x4f0
[ 778.329902] ? inet_gro_receive+0x2
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.6-1 (bookworm) | linux 5.14.6-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 038ebb1a713d114d54dbf14868a73181c0c92758 < ac493452e937b8939eaf2d24cac51a4804b6c20e | ac493452e937b8939eaf2d24cac51a4804b6c20e |
| linux | linux | >= 038ebb1a713d114d54dbf14868a73181c0c92758 < 86ab133b695ed7ba1f8786b12f4ca43137ad8c18 | 86ab133b695ed7ba1f8786b12f4ca43137ad8c18 |
| linux | linux | >= 038ebb1a713d114d54dbf14868a73181c0c92758 < 9453d45ecb6c2199d72e73c993e9d98677a2801b | 9453d45ecb6c2199d72e73c993e9d98677a2801b |
| linux | linux | >= 5.7.15 < 5.8 | 5.8 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 5.11 < 5.12.9 | 5.12.9 |
| linux | linux_kernel | >= 5.9 < 5.10.42 | 5.10.42 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 5.10.41/5.12.8 net/openvswitch/flow.c skb_ext_add uninitialized pointer (ac493452e937/86ab133b695e/9453d45ecb6c / WID-SEC-2024-0699)
vuldb·2026-08-05·CVSS 5.5
CVE-2021-47136 [MEDIUM] Linux Kernel up to 5.10.41/5.12.8 net/openvswitch/flow.c skb_ext_add uninitialized pointer (ac493452e937/86ab133b695e/9453d45ecb6c / WID-SEC-2024-0699)
A vulnerability was found in Linux Kernel up to 5.10.41/5.12.8. It has been rated as problematic. Affected is the function skb_ext_add of the file net/openvswitch/flow.c. Performing a manipulation results in uninitialized pointer.
This vulnerability is reported as CVE-2021-47136. The attacker must have access to the local network to execute the attack. No exploit exists.
Upgrading the affected component is advised.
GHSA
GHSA-7cg4-mp48-cggr: In the Linux kernel, the following vulnerability has been resolved:
net: zero-initialize tc skb extension on allocation
Function skb_ext_add() doesn
ghsa_unreviewed·2024-03-25
CVE-2021-47136 [MEDIUM] CWE-908 GHSA-7cg4-mp48-cggr: In the Linux kernel, the following vulnerability has been resolved:
net: zero-initialize tc skb extension on allocation
Function skb_ext_add() doesn
In the Linux kernel, the following vulnerability has been resolved:
net: zero-initialize tc skb extension on allocation
Function skb_ext_add() doesn't initialize created skb extension with any
value and leaves it up to the user. However, since extension of type
TC_SKB_EXT originally contained only single value tc_skb_ext->chain its
users used to just assign the chain value without setting whole extension
memory to zero first. This assumption changed when TC_SKB_EXT extension was
extended with additional fields but not all users were updated to
initialize the new fields which leads to use of uninitialized memory
afterwards. UBSAN log:
[ 778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28
[ 778.301495] load of value 107 is not a valid value for type '_Bool'
[ 778.303215] CPU:
OSV
CVE-2021-47136: In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocation Function skb_ext_add() doesn't
osv·2024-03-25·CVSS 5.5
CVE-2021-47136 [MEDIUM] CVE-2021-47136: In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocation Function skb_ext_add() doesn't
In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocation Function skb_ext_add() doesn't initialize created skb extension with any value and leaves it up to the user. However, since extension of type TC_SKB_EXT originally contained only single value tc_skb_ext->chain its users used to just assign the chain value without setting whole extension memory to zero first. This assumption changed when TC_SKB_EXT extension was extended with additional fields but not all users were updated to initialize the new fields which leads to use of uninitialized memory afterwards. UBSAN log: [ 778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28 [ 778.301495] load of value 107 is not a valid value for type '_Bool' [ 778.303215] CPU: 0
Red Hat
kernel: net: zero-initialize tc skb extension on allocation
vendor_redhat·2024-03-25·CVSS 5.5
CVE-2021-47136 [MEDIUM] CWE-20 kernel: net: zero-initialize tc skb extension on allocation
kernel: net: zero-initialize tc skb extension on allocation
In the Linux kernel, the following vulnerability has been resolved:
net: zero-initialize tc skb extension on allocation
Function skb_ext_add() doesn't initialize created skb extension with any
value and leaves it up to the user. However, since extension of type
TC_SKB_EXT originally contained only single value tc_skb_ext->chain its
users used to just assign the chain value without setting whole extension
memory to zero first. This assumption changed when TC_SKB_EXT extension was
extended with additional fields but not all users were updated to
initialize the new fields which leads to use of uninitialized memory
afterwards. UBSAN log:
[ 778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28
[ 778.301495] load of value 10
Debian
CVE-2021-47136: linux - In the Linux kernel, the following vulnerability has been resolved: net: zero-i...
vendor_debian·2021·CVSS 5.5
CVE-2021-47136 [MEDIUM] CVE-2021-47136: linux - In the Linux kernel, the following vulnerability has been resolved: net: zero-i...
In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocation Function skb_ext_add() doesn't initialize created skb extension with any value and leaves it up to the user. However, since extension of type TC_SKB_EXT originally contained only single value tc_skb_ext->chain its users used to just assign the chain value without setting whole extension memory to zero first. This assumption changed when TC_SKB_EXT extension was extended with additional fields but not all users were updated to initialize the new fields which leads to use of uninitialized memory afterwards. UBSAN log: [ 778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28 [ 778.301495] load of value 107 is not a valid value for type '_Bool' [ 778.303215] CPU: 0
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/86ab133b695ed7ba1f8786b12f4ca43137ad8c18https://git.kernel.org/stable/c/9453d45ecb6c2199d72e73c993e9d98677a2801bhttps://git.kernel.org/stable/c/ac493452e937b8939eaf2d24cac51a4804b6c20ehttps://git.kernel.org/stable/c/86ab133b695ed7ba1f8786b12f4ca43137ad8c18https://git.kernel.org/stable/c/9453d45ecb6c2199d72e73c993e9d98677a2801bhttps://git.kernel.org/stable/c/ac493452e937b8939eaf2d24cac51a4804b6c20e
2024-03-25
Published