PT-2021-8259 · Linux+1 · Linux Kernel+1

Pablo Neira Ayuso · Published 2021-05-27 · Updated 2024-11-07 · CVE-2021-47129

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The vulnerability is related to the nft ct expect obj eval() function in the Linux kernel's netfilter component. It is caused by the function calling nf ct ext add() for a confirmed conntrack entry, although nf ct ext add() can only be called for unconfirmed conntrack entries. This can lead to a denial of service. The issue can be mitigated by adding a new action to attach a generic ct helper to the first packet and using this ct helper extension from follow-up packets to create the ct expectation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-273

Related Identifiers

BDU:2025-00797

CVE-2021-47129

Affected Products

Astra Linux

Linux Kernel

References · 17

• https://bdu.fstec.ru/vul/2025-00797 · Security Note
• https://git.kernel.org/stable/c/da8d31e80ff425f5a65dab7060d5c4aba749e562 · Patch
• https://git.kernel.org/stable/c/2c0e6b35b88a961127066a1028bce9c727cbc3e5 · Patch
• https://osv.dev/vulnerability/CVE-2021-47129 · Vendor Advisory
• https://git.kernel.org/stable/c/1710eb913bdcda3917f44d383c32de6bdabfc836 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47129 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-47129 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-47129 · Vendor Advisory
• https://git.kernel.org/stable/c/5f3429c05e4028a0e241afdad856dd15dec2ffb9 · Patch
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47129 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47129 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-47129 · Vendor Advisory
• https://twitter.com/AndreSilv593638/status/1769575509795446958 · Twitter Post
• https://git.kernel.org/linus/1710eb913bdcda3917f44d383c32de6bdabfc836 · Note