CVE-2021-47152
published 2024-03-25CVE-2021-47152: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data stream corruption Maxim reported several issues when forcing a TCP…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
15.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix data stream corruption
Maxim reported several issues when forcing a TCP transparent proxy
to use the MPTCP protocol for the inbound connections. He also
provided a clean reproducer.
The problem boils down to 'mptcp_frag_can_collapse_to()' assuming
that only MPTCP will use the given page_frag.
If others - e.g. the plain TCP protocol - allocate page fragments,
we can end-up re-using already allocated memory for mptcp_data_frag.
Fix the issue ensuring that the to-be-expanded data fragment is
located at the current page frag end.
v1 -> v2:
- added missing fixes tag (Mat)
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.6-1 (bookworm) | linux 5.14.6-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 18b683bff89d46ace55f12d00c0440d44d6160c4 < 3267a061096efc91eda52c2a0c61ba76e46e4b34 | 3267a061096efc91eda52c2a0c61ba76e46e4b34 |
| linux | linux | >= 18b683bff89d46ace55f12d00c0440d44d6160c4 < 18e7f0580da15cac1e79d73683ada5a9e70980f8 | 18e7f0580da15cac1e79d73683ada5a9e70980f8 |
| linux | linux | >= 18b683bff89d46ace55f12d00c0440d44d6160c4 < 29249eac5225429b898f278230a6ca2baa1ae154 | 29249eac5225429b898f278230a6ca2baa1ae154 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 5.11 < 5.12.9 | 5.12.9 |
| linux | linux_kernel | >= 5.7 < 5.10.42 | 5.10.42 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 5.10.41/5.12.8 MPTCP Protocol mptcp_frag_can_collapse_to allocation of resources (3267a061096e/18e7f0580da1/29249eac5225 / WID-SEC-2024-0699)
vuldb·2026-08-05·CVSS 5.5
CVE-2021-47152 [MEDIUM] Linux Kernel up to 5.10.41/5.12.8 MPTCP Protocol mptcp_frag_can_collapse_to allocation of resources (3267a061096e/18e7f0580da1/29249eac5225 / WID-SEC-2024-0699)
A vulnerability has been found in Linux Kernel up to 5.10.41/5.12.8 and classified as critical. This issue affects the function mptcp_frag_can_collapse_to of the component MPTCP Protocol Handler. The manipulation leads to allocation of resources.
This vulnerability is referenced as CVE-2021-47152. The attack needs to be initiated within the local network. No exploit is available.
The affected component should be upgraded.
GHSA
GHSA-ffg6-3wfr-47xc: In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix data stream corruption
Maxim reported several issues when forcing a T
ghsa_unreviewed·2024-03-25
CVE-2021-47152 [MEDIUM] CWE-787 GHSA-ffg6-3wfr-47xc: In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix data stream corruption
Maxim reported several issues when forcing a T
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix data stream corruption
Maxim reported several issues when forcing a TCP transparent proxy
to use the MPTCP protocol for the inbound connections. He also
provided a clean reproducer.
The problem boils down to 'mptcp_frag_can_collapse_to()' assuming
that only MPTCP will use the given page_frag.
If others - e.g. the plain TCP protocol - allocate page fragments,
we can end-up re-using already allocated memory for mptcp_data_frag.
Fix the issue ensuring that the to-be-expanded data fragment is
located at the current page frag end.
v1 -> v2:
- added missing fixes tag (Mat)
OSV
CVE-2021-47152: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data stream corruption Maxim reported several issues when forcing a TCP
osv·2024-03-25·CVSS 5.5
CVE-2021-47152 [MEDIUM] CVE-2021-47152: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data stream corruption Maxim reported several issues when forcing a TCP
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data stream corruption Maxim reported several issues when forcing a TCP transparent proxy to use the MPTCP protocol for the inbound connections. He also provided a clean reproducer. The problem boils down to 'mptcp_frag_can_collapse_to()' assuming that only MPTCP will use the given page_frag. If others - e.g. the plain TCP protocol - allocate page fragments, we can end-up re-using already allocated memory for mptcp_data_frag. Fix the issue ensuring that the to-be-expanded data fragment is located at the current page frag end. v1 -> v2: - added missing fixes tag (Mat)
Red Hat
kernel: mptcp: fix data stream corruption
vendor_redhat·2024-03-25·CVSS 5.5
CVE-2021-47152 [MEDIUM] CWE-99 kernel: mptcp: fix data stream corruption
kernel: mptcp: fix data stream corruption
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix data stream corruption
Maxim reported several issues when forcing a TCP transparent proxy
to use the MPTCP protocol for the inbound connections. He also
provided a clean reproducer.
The problem boils down to 'mptcp_frag_can_collapse_to()' assuming
that only MPTCP will use the given page_frag.
If others - e.g. the plain TCP protocol - allocate page fragments,
we can end-up re-using already allocated memory for mptcp_data_frag.
Fix the issue ensuring that the to-be-expanded data fragment is
located at the current page frag end.
v1 -> v2:
- added missing fixes tag (Mat)
A potential data stream corruption flaw was found in the Linux kernel. This may result in a crash.
Pac
Debian
CVE-2021-47152: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: fix ...
vendor_debian·2021·CVSS 5.5
CVE-2021-47152 [MEDIUM] CVE-2021-47152: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: fix ...
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data stream corruption Maxim reported several issues when forcing a TCP transparent proxy to use the MPTCP protocol for the inbound connections. He also provided a clean reproducer. The problem boils down to 'mptcp_frag_can_collapse_to()' assuming that only MPTCP will use the given page_frag. If others - e.g. the plain TCP protocol - allocate page fragments, we can end-up re-using already allocated memory for mptcp_data_frag. Fix the issue ensuring that the to-be-expanded data fragment is located at the current page frag end. v1 -> v2: - added missing fixes tag (Mat)
Scope: local
bookworm: resolved (fixed in 5.14.6-1)
bullseye: resolved (fixed in 5.10.46-1)
forky: resolved (fixed in 5.14.6-1)
sid: resolved (fixe
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34
2024-03-25
Published