PT-2021-8146 · Linux+4 · Linux Kernel+4

Ignat Korchagin · Published 2021-12-23 · Updated 2024-10-31 · CVE-2021-47099

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.16.0-rc5+

Description The vulnerability is related to the veth component of the Linux kernel, which fails to properly check for shared or cloned skbs when GRO is enabled on a veth device and TSO is disabled on the peer device. This can lead to a kernel bug and potentially cause a denial of service. The issue is addressed by skipping the GRO stage for shared or cloned skbs and trying to unclone the skbs before giving up.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for this vulnerability. Specifically, versions prior to 5.16.0-rc5+ are affected, so updating to 5.16.0-rc5+ or later should resolve the issue.

Note: The provided information does not specify the exact version that includes the fix, but it is clear that versions prior to 5.16.0-rc5+ are vulnerable.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-08418

CESA-2022_7444

CESA-2022_7683

CVE-2021-47099

OPENSUSE-SU-2024_1321-1

OPENSUSE-SU-2024_1322-1

OPENSUSE-SU-2024_1322-2

OPENSUSE-SU-2024_1332-1

OPENSUSE-SU-2024_1332-2

OPENSUSE-SU-2024_1466-1

OPENSUSE-SU-2024_1480-1

OPENSUSE-SU-2024_1490-1

RHSA-2022:7444

RHSA-2022:7683

RHSA-2022:7933

RHSA-2022:8267

RHSA-2022_7444

RHSA-2022_7683

RHSA-2022_7933

RHSA-2022_8267

RHSA-2024:1877

SUSE-SU-2024:1320-1

SUSE-SU-2024:1321-1

SUSE-SU-2024:1466-1

SUSE-SU-2024:1480-1

SUSE-SU-2024:1490-1

Affected Products

Centos

Linux Kernel

Red Hat

Red Os

Suse

References · 463

• https://osv.dev/vulnerability/SUSE-SU-2024:1320-1 · Vendor Advisory
• https://git.kernel.org/stable/c/d2269ae48598e05b59ec9ea9e6e44fd33941130d · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:1321-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47099 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1480-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47099 · Vendor Advisory
• https://git.kernel.org/stable/c/9695b7de5b4760ed22132aca919570c0190cb0ce · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-47099 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1466-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-47099 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47099 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08418 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-47099 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1490-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-47099 · Vendor Advisory