PT-2021-8025 · Linux+2 · Linux Kernel+2

Laura Garcia Liebana · Published 2021-04-13 · Updated 2024-04-22 · CVE-2021-46913

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The vulnerability is related to the netfilter component of the Linux kernel, specifically with the nftables subsystem. It occurs when using connlimit in set elements, causing the memcpy() function to break. This can lead to a crash of the connlimit garbage collector when walking on the list head copy. The issue can be resolved by using the nft expr clone() function to initialize the connlimit expression list.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-03148

CVE-2021-46913

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 20

• https://security-tracker.debian.org/tracker/CVE-2021-46913 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46913 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46913 · Vendor Advisory
• https://git.kernel.org/stable/c/4d8f9065830e526c83199186c5f56a6514f457d2 · Patch
• https://git.kernel.org/stable/c/e51ff3ffc316377cca21de8b80404eed0c37b3c3 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46913 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46913 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-46913 · Security Note
• https://git.kernel.org/stable/c/47d8de3c226574a3ddb8b87d0c152028d1bafef4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-46913 · Security Note
• https://bdu.fstec.ru/vul/2024-03148 · Security Note
• https://lore.kernel.org/linux-cve-announce/2024022708-CVE-2021-46913-eeef@gregkh · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.16 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-yadra-os-18-04-24 · Note
• https://lore.kernel.org/linux-cve-announce/2024022708-CVE-2021-46913-eeef@gregkh/T/#u · Note