CVE-2021-47244
published 2024-05-21CVE-2021-47244: In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix out of bounds when parsing TCP options The TCP option parser in mptcp…
PriorityP340high8.2CVSS 3.1
AVNACLPRNUINSUCLINAH
EPSS
0.72%
53.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
mptcp: Fix out of bounds when parsing TCP options
The TCP option parser in mptcp (mptcp_get_options) could read one byte
out of bounds. When the length is 1, the execution flow gets into the
loop, reads one byte of the opcode, and if the opcode is neither
TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the
length of 1.
This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.46-1 (bookworm) | linux 5.10.46-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= cec37a6e41aae7bf3df9a3da783380a4d9325fd8 < 73eeba71dc9932970befa009e68272a3d5ec4a58 | 73eeba71dc9932970befa009e68272a3d5ec4a58 |
| linux | linux | >= cec37a6e41aae7bf3df9a3da783380a4d9325fd8 < 76e02b8905d0691e89e104a882f3bba7dd0f6037 | 76e02b8905d0691e89e104a882f3bba7dd0f6037 |
| linux | linux | >= cec37a6e41aae7bf3df9a3da783380a4d9325fd8 < 07718be265680dcf496347d475ce1a5442f55ad7 | 07718be265680dcf496347d475ce1a5442f55ad7 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 5.11 < 5.12.13 | 5.12.13 |
| linux | linux_kernel | >= 5.6 < 5.10.46 | 5.10.46 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
osv6.2MEDIUM
vendor_debian6.2MEDIUM
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: mptcp: Fix out of bounds when parsing TCP options
vendor_redhat·2024-05-21·CVSS 6.2
CVE-2021-47244 [MEDIUM] CWE-125 kernel: mptcp: Fix out of bounds when parsing TCP options
kernel: mptcp: Fix out of bounds when parsing TCP options
In the Linux kernel, the following vulnerability has been resolved:
mptcp: Fix out of bounds when parsing TCP options
The TCP option parser in mptcp (mptcp_get_options) could read one byte
out of bounds. When the length is 1, the execution flow gets into the
loop, reads one byte of the opcode, and if the opcode is neither
TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the
length of 1.
This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").
A vulnerability was found in the Linux kernel's mptcp implementation, where theTCP option parser in mptcp (mptcp_get_options) could read one byte
out of bounds. When the length is 1, the execution flow gets into the
lo
Debian
CVE-2021-47244: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix ...
vendor_debian·2021·CVSS 6.2
CVE-2021-47244 [MEDIUM] CVE-2021-47244: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix ...
In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix out of bounds when parsing TCP options The TCP option parser in mptcp (mptcp_get_options) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1. This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack out of bounds when parsing TCP options.").
Scope: local
bookworm: resolved (fixed in 5.10.46-1)
bullseye: resolved (fixed in 5.10.46-1)
forky: resolved (fixed in 5.10.46-1)
sid: resolved (fixed in 5.10.46-1)
trixie: resolved (fixed in 5.10.46-1)
GHSA
GHSA-grfr-gx46-j682: In the Linux kernel, the following vulnerability has been resolved:
mptcp: Fix out of bounds when parsing TCP options
The TCP option parser in mptcp
ghsa_unreviewed·2024-05-21
CVE-2021-47244 [MEDIUM] CWE-125 GHSA-grfr-gx46-j682: In the Linux kernel, the following vulnerability has been resolved:
mptcp: Fix out of bounds when parsing TCP options
The TCP option parser in mptcp
In the Linux kernel, the following vulnerability has been resolved:
mptcp: Fix out of bounds when parsing TCP options
The TCP option parser in mptcp (mptcp_get_options) could read one byte
out of bounds. When the length is 1, the execution flow gets into the
loop, reads one byte of the opcode, and if the opcode is neither
TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the
length of 1.
This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").
OSV
CVE-2021-47244: In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix out of bounds when parsing TCP options The TCP option parser in mptcp (
osv·2024-05-21·CVSS 6.2
CVE-2021-47244 [MEDIUM] CVE-2021-47244: In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix out of bounds when parsing TCP options The TCP option parser in mptcp (
In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix out of bounds when parsing TCP options The TCP option parser in mptcp (mptcp_get_options) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1. This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack out of bounds when parsing TCP options.").
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/07718be265680dcf496347d475ce1a5442f55ad7https://git.kernel.org/stable/c/73eeba71dc9932970befa009e68272a3d5ec4a58https://git.kernel.org/stable/c/76e02b8905d0691e89e104a882f3bba7dd0f6037https://git.kernel.org/stable/c/07718be265680dcf496347d475ce1a5442f55ad7https://git.kernel.org/stable/c/73eeba71dc9932970befa009e68272a3d5ec4a58https://git.kernel.org/stable/c/76e02b8905d0691e89e104a882f3bba7dd0f6037
2024-05-21
Published