CVE-2021-47588
published 2024-06-19CVE-2021-47588: In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6_dev_free() from sit_init_net() ipip6_dev_free is sit…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.26%
18.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
sit: do not call ipip6_dev_free() from sit_init_net()
ipip6_dev_free is sit dev->priv_destructor, already called
by register_netdevice() if something goes wrong.
Alternative would be to make ipip6_dev_free() robust against
multiple invocations, but other drivers do not implement this
strategy.
syzbot reported:
dst_release underflow
WARNING: CPU: 0 PID: 5059 at net/core/dst.c:173 dst_release+0xd8/0xe0 net/core/dst.c:173
Modules linked in:
CPU: 1 PID: 5059 Comm: syz-executor.4 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dst_release+0xd8/0xe0 net/core/dst.c:173
Code: 4c 89 f2 89 d9 31 c0 5b 41 5e 5d e9 da d5 44 f9 e8 1d 90 5f f9 c6 05 87 48 c6 05 01 48 c7 c7 80 44 99 8b 31 c0 e8 e8 67 29 f9 0b eb 85 0f 1f 40 00 53 48 89 fb e8 f7 8f 5f f9 48 83 c3 a8 48
RSP: 0018:ffffc9000aa5faa0 EFLAGS: 00010246
RAX: d6894a925dd15a00 RBX: 00000000ffffffff RCX: 0000000000040000
RDX: ffffc90005e19000 RSI: 000000000003ffff RDI: 0000000000040000
RBP: 0000000000000000 R08: ffffffff816a1f42 R09: ffffed1017344f2c
R10: ffffed1017344f2c R11: 0000000000000000 R12: 0000607f462b1358
R13: 1ffffffff1bfd305 R14: ffffe8ffffcb1358 R15: dffffc0000000000
FS: 00007f66c71a2700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f88aaed5058 CR3: 0000000023e0f000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
dst_cache_destroy+0x107/0x1e0 net/core/dst_cache.c:160
ipip6_dev_free net/ipv6/sit.c:1414 [inline]
sit_init_net+0x229/0x550 net/ipv6/sit.c:1936
ops_init+0x313/0x430 net/core/net_namespace.c:140
setup_net+0x35b/0x9d0 net/core/net_namespace.c:326
copy_net_ns+0x359/0x5c0 net/core/net_namespace.c:470
create_new_namespaces+0x4ce/0xa00 kernel/nsproxy.c:110
unshare_nspr
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.15.15-1 (bookworm) | linux 5.15.15-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 4.11.9 < 4.12 | 4.12 |
| linux | linux | >= cf124db566e6b036b8bcbe8decbed740bdfac8c6 < 4e1797914d8f223726ff6ae5ece4f97d73f21bab | 4e1797914d8f223726ff6ae5ece4f97d73f21bab |
| linux | linux | >= cf124db566e6b036b8bcbe8decbed740bdfac8c6 < e56b65c1e74d7f706d74b51baba15187be2fb4b5 | e56b65c1e74d7f706d74b51baba15187be2fb4b5 |
| linux | linux | >= cf124db566e6b036b8bcbe8decbed740bdfac8c6 < ad0ed314d6167b212939e3839428ba0c8bb16adb | ad0ed314d6167b212939e3839428ba0c8bb16adb |
| linux | linux | >= cf124db566e6b036b8bcbe8decbed740bdfac8c6 < 6f46c59e60b64620d5d386c8ee2eaa11ebe3b595 | 6f46c59e60b64620d5d386c8ee2eaa11ebe3b595 |
| linux | linux | >= cf124db566e6b036b8bcbe8decbed740bdfac8c6 < 44a6c846bc3a7efe7d394bab8b2ae3b7f580e190 | 44a6c846bc3a7efe7d394bab8b2ae3b7f580e190 |
| linux | linux | >= cf124db566e6b036b8bcbe8decbed740bdfac8c6 < e28587cc491ef0f3c51258fdc87fbc386b1d4c59 | e28587cc491ef0f3c51258fdc87fbc386b1d4c59 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.92-1 | 5.10.92-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 0 < 5.15.15-1 | 5.15.15-1 |
| linux | linux_kernel | >= 4.11.9 < 4.12 | 4.12 |
| linux | linux_kernel | >= 4.12.1 < 4.14.259 | 4.14.259 |
| linux | linux_kernel | >= 4.15 < 4.19.222 | 4.19.222 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2021-47588: In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6_dev_free() from sit_init_net() ipip6_dev_free is sit dev->p
osv·2024-06-19·CVSS 5.5
CVE-2021-47588 [MEDIUM] CVE-2021-47588: In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6_dev_free() from sit_init_net() ipip6_dev_free is sit dev->p
In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6_dev_free() from sit_init_net() ipip6_dev_free is sit dev->priv_destructor, already called by register_netdevice() if something goes wrong. Alternative would be to make ipip6_dev_free() robust against multiple invocations, but other drivers do not implement this strategy. syzbot reported: dst_release underflow WARNING: CPU: 0 PID: 5059 at net/core/dst.c:173 dst_release+0xd8/0xe0 net/core/dst.c:173 Modules linked in: CPU: 1 PID: 5059 Comm: syz-executor.4 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:dst_release+0xd8/0xe0 net/core/dst.c:173 Code: 4c 89 f2 89 d9 31 c0 5b 41 5e 5d e9 da d5 44 f9 e8 1d 90 5f f9 c6 05
GHSA
GHSA-g3vj-5c3x-wjr4: In the Linux kernel, the following vulnerability has been resolved:
sit: do not call ipip6_dev_free() from sit_init_net()
ipip6_dev_free is sit dev-
ghsa_unreviewed·2024-06-19
CVE-2021-47588 [MEDIUM] GHSA-g3vj-5c3x-wjr4: In the Linux kernel, the following vulnerability has been resolved:
sit: do not call ipip6_dev_free() from sit_init_net()
ipip6_dev_free is sit dev-
In the Linux kernel, the following vulnerability has been resolved:
sit: do not call ipip6_dev_free() from sit_init_net()
ipip6_dev_free is sit dev->priv_destructor, already called
by register_netdevice() if something goes wrong.
Alternative would be to make ipip6_dev_free() robust against
multiple invocations, but other drivers do not implement this
strategy.
syzbot reported:
dst_release underflow
WARNING: CPU: 0 PID: 5059 at net/core/dst.c:173 dst_release+0xd8/0xe0 net/core/dst.c:173
Modules linked in:
CPU: 1 PID: 5059 Comm: syz-executor.4 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dst_release+0xd8/0xe0 net/core/dst.c:173
Code: 4c 89 f2 89 d9 31 c0 5b 41 5e 5d e9 da d5 44 f9 e8 1d 90 5f f9 c
Red Hat
kernel: sit: do not call ipip6_dev_free() from sit_init_net()
vendor_redhat·2024-06-19·CVSS 5.5
CVE-2021-47588 [MEDIUM] CWE-911 kernel: sit: do not call ipip6_dev_free() from sit_init_net()
kernel: sit: do not call ipip6_dev_free() from sit_init_net()
In the Linux kernel, the following vulnerability has been resolved:
sit: do not call ipip6_dev_free() from sit_init_net()
ipip6_dev_free is sit dev->priv_destructor, already called
by register_netdevice() if something goes wrong.
Alternative would be to make ipip6_dev_free() robust against
multiple invocations, but other drivers do not implement this
strategy.
syzbot reported:
dst_release underflow
WARNING: CPU: 0 PID: 5059 at net/core/dst.c:173 dst_release+0xd8/0xe0 net/core/dst.c:173
Modules linked in:
CPU: 1 PID: 5059 Comm: syz-executor.4 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dst_release+0xd8/0xe0 net/core/dst.c:173
Code: 4c 89
Debian
CVE-2021-47588: linux - In the Linux kernel, the following vulnerability has been resolved: sit: do not...
vendor_debian·2021·CVSS 5.5
CVE-2021-47588 [MEDIUM] CVE-2021-47588: linux - In the Linux kernel, the following vulnerability has been resolved: sit: do not...
In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6_dev_free() from sit_init_net() ipip6_dev_free is sit dev->priv_destructor, already called by register_netdevice() if something goes wrong. Alternative would be to make ipip6_dev_free() robust against multiple invocations, but other drivers do not implement this strategy. syzbot reported: dst_release underflow WARNING: CPU: 0 PID: 5059 at net/core/dst.c:173 dst_release+0xd8/0xe0 net/core/dst.c:173 Modules linked in: CPU: 1 PID: 5059 Comm: syz-executor.4 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:dst_release+0xd8/0xe0 net/core/dst.c:173 Code: 4c 89 f2 89 d9 31 c0 5b 41 5e 5d e9 da d5 44 f9 e8 1d 90 5f f9 c6 05
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/44a6c846bc3a7efe7d394bab8b2ae3b7f580e190https://git.kernel.org/stable/c/4e1797914d8f223726ff6ae5ece4f97d73f21babhttps://git.kernel.org/stable/c/6f46c59e60b64620d5d386c8ee2eaa11ebe3b595https://git.kernel.org/stable/c/ad0ed314d6167b212939e3839428ba0c8bb16adbhttps://git.kernel.org/stable/c/e28587cc491ef0f3c51258fdc87fbc386b1d4c59https://git.kernel.org/stable/c/e56b65c1e74d7f706d74b51baba15187be2fb4b5https://git.kernel.org/stable/c/44a6c846bc3a7efe7d394bab8b2ae3b7f580e190https://git.kernel.org/stable/c/4e1797914d8f223726ff6ae5ece4f97d73f21babhttps://git.kernel.org/stable/c/6f46c59e60b64620d5d386c8ee2eaa11ebe3b595https://git.kernel.org/stable/c/ad0ed314d6167b212939e3839428ba0c8bb16adbhttps://git.kernel.org/stable/c/e28587cc491ef0f3c51258fdc87fbc386b1d4c59https://git.kernel.org/stable/c/e56b65c1e74d7f706d74b51baba15187be2fb4b5
2024-06-19
Published