CVE-2021-47222
published 2024-05-21CVE-2021-47222: In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst refcnt when egressing The egress tunnel code uses…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
15.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix vlan tunnel dst refcnt when egressing
The egress tunnel code uses dst_clone() and directly sets the result
which is wrong because the entry might have 0 refcnt or be already deleted,
causing number of problems. It also triggers the WARN_ON() in dst_hold()[1]
when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and
checking if a reference was actually taken before setting the dst.
[1] dmesg WARN_ON log and following refcnt errors
WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]
Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net
CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G W 5.13.0-rc3+ #360
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]
Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49
RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0
RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001
R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401
FS: 0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0
Call Trace:
br_handle_vlan+0xbc/0xca [bridge]
__br_forward+0x23/0x164 [bridge]
deliver_clone+0x41/0x48 [bridge]
br_handle_frame_finish+0x36f/0x3aa [bridge]
? skb_dst+0x2e/0x38 [bridge]
? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge]
? br_handle_frame_finish+0x3aa/0x3aa [bridge]
br_handle_frame+0x2c3/0x377 [b
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.46-1 (bookworm) | linux 5.10.46-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < 42020f7f37a90d24b9551f5f7eba3f7c7c102968 | 42020f7f37a90d24b9551f5f7eba3f7c7c102968 |
| linux | linux | >= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < 84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e | 84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e |
| linux | linux | >= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < 79855be6445b6592bddb7bd7167083ec8cdbd73f | 79855be6445b6592bddb7bd7167083ec8cdbd73f |
| linux | linux | >= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579 | fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579 |
| linux | linux | >= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < 25053a8404ba17ca48f5553d487afc1882e9f56c | 25053a8404ba17ca48f5553d487afc1882e9f56c |
| linux | linux | >= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < cfc579f9d89af4ada58c69b03bcaa4887840f3b3 | cfc579f9d89af4ada58c69b03bcaa4887840f3b3 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 4.11 < 4.14.238 | 4.14.238 |
| linux | linux_kernel | >= 4.15 < 4.19.196 | 4.19.196 |
| linux | linux_kernel | >= 4.20 < 5.4.128 | 5.4.128 |
| linux | linux_kernel | >= 5.11 < 5.12.13 | 5.12.13 |
| linux | linux_kernel | >= 5.5 < 5.10.46 | 5.10.46 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net: bridge: fix vlan tunnel dst refcnt when egressing
vendor_redhat·2024-05-21·CVSS 7.8
CVE-2021-47222 [HIGH] kernel: net: bridge: fix vlan tunnel dst refcnt when egressing
kernel: net: bridge: fix vlan tunnel dst refcnt when egressing
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix vlan tunnel dst refcnt when egressing
The egress tunnel code uses dst_clone() and directly sets the result
which is wrong because the entry might have 0 refcnt or be already deleted,
causing number of problems. It also triggers the WARN_ON() in dst_hold()[1]
when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and
checking if a reference was actually taken before setting the dst.
[1] dmesg WARN_ON log and following refcnt errors
WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]
Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net
CPU: 5 PID: 38 Comm: ksoftirqd/5 K
Debian
CVE-2021-47222: linux - In the Linux kernel, the following vulnerability has been resolved: net: bridge...
vendor_debian·2021·CVSS 7.8
CVE-2021-47222 [HIGH] CVE-2021-47222: linux - In the Linux kernel, the following vulnerability has been resolved: net: bridge...
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst refcnt when egressing The egress tunnel code uses dst_clone() and directly sets the result which is wrong because the entry might have 0 refcnt or be already deleted, causing number of problems. It also triggers the WARN_ON() in dst_hold()[1] when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and checking if a reference was actually taken before setting the dst. [1] dmesg WARN_ON log and following refcnt errors WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge] Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G W 5.13.0-rc3+ #360 Hardware name: QEMU S
OSV
CVE-2021-47222: In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst refcnt when egressing The egress tunnel code uses
osv·2024-05-21·CVSS 7.8
CVE-2021-47222 [HIGH] CVE-2021-47222: In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst refcnt when egressing The egress tunnel code uses
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst refcnt when egressing The egress tunnel code uses dst_clone() and directly sets the result which is wrong because the entry might have 0 refcnt or be already deleted, causing number of problems. It also triggers the WARN_ON() in dst_hold()[1] when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and checking if a reference was actually taken before setting the dst. [1] dmesg WARN_ON log and following refcnt errors WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge] Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G W 5.13.0-rc3+ #360 Hardware name: QEMU S
GHSA
GHSA-h423-6g7m-qpqq: In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix vlan tunnel dst refcnt when egressing
The egress tunnel code us
ghsa_unreviewed·2024-05-21
CVE-2021-47222 [HIGH] CWE-416 GHSA-h423-6g7m-qpqq: In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix vlan tunnel dst refcnt when egressing
The egress tunnel code us
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix vlan tunnel dst refcnt when egressing
The egress tunnel code uses dst_clone() and directly sets the result
which is wrong because the entry might have 0 refcnt or be already deleted,
causing number of problems. It also triggers the WARN_ON() in dst_hold()[1]
when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and
checking if a reference was actually taken before setting the dst.
[1] dmesg WARN_ON log and following refcnt errors
WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]
Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net
CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G W 5.13.0-rc3+ #360
Hardware name: QEM
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56chttps://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73fhttps://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6ehttps://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56chttps://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73fhttps://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6ehttps://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579
2024-05-21
Published