PT-2021-8038 · Linux · Linux Kernel

Shuang Li · Published 2021-04-29 · Updated 2024-04-10 · CVE-2021-46954

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.12.0-rc6+

Description The vulnerability is related to a stack out-of-bounds read in the sch frag function when fragmenting IPv4 packets. This occurs when act mirred tries to fragment IPv4 packets that had been previously re-assembled using act ct. The issue arises from the use of a temporary struct dst entry in sch fragment(), which is then used as a pointer to struct rtable in the call graph, leading to an out-of-bounds read in the stack.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. Specifically, the fix involves changing the temporary variable used for IPv4 packets in sch fragment(), similar to what is done for IPv6.

As a temporary workaround, consider disabling the sch fragment() function until a patch is available. However, this may have significant performance implications and should be carefully considered based on specific system requirements and constraints.

At the moment, there is no information about a newer version that contains a fix for this vulnerability, other than ensuring the kernel is updated beyond version 5.12.0-rc6+.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2024-03694

CVE-2021-46954

Affected Products

Linux Kernel

References · 15

• https://cve.org/CVERecord?id=CVE-2021-46954 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46954 · Vendor Advisory
• https://git.kernel.org/stable/c/8e6dfb7beeb6489ac1365b8a71052e737f5da76e · Patch
• https://git.kernel.org/stable/c/31fe34a0118e0acc958c802e830ad5d37ef6b1d3 · Patch
• https://osv.dev/vulnerability/CVE-2021-46954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46954 · Security Note
• https://git.kernel.org/stable/c/018bb8da5b5888e19585f9b802f036afe643fcef · Patch
• https://bdu.fstec.ru/vul/2024-03694 · Security Note
• https://ubuntu.com/security/CVE-2021-46954 · Vendor Advisory
• https://git.kernel.org/linus/31fe34a0118e0acc958c802e830ad5d37ef6b1d3 · Note
• https://lore.kernel.org/linux-cve-announce/2024022715-CVE-2021-46954-b856@gregkh/T/#u · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.3 · Note
• https://twitter.com/CVEnew/status/1762551312447684832 · Twitter Post
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.20 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46954 · Note