PT-2021-8274 · Linux+3 · Linux Kernel+3
Davide Caratti
·
Published
2021-04-28
·
Updated
2025-01-27
·
CVE-2021-46955
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.12.0-rc6+
Description
The vulnerability is related to a stack out-of-bounds read in the
ip do fragment function when fragmenting IPv4 packets. This occurs when the ovs fragment function uses a temporary struct dst entry and the pointer to this structure is used as a pointer to struct rtable, leading to an out-of-bounds read in the stack. The issue can be fixed by changing the temporary variable used for IPv4 packets in ovs fragment, similar to what is done for IPv6.Recommendations
To resolve the issue, update the Linux kernel to a version that includes the fix for the stack out-of-bounds read in
ip do fragment. As a temporary workaround, consider disabling the ovs fragment function until a patch is available. Restrict access to the vulnerable openvswitch module to minimize the risk of exploitation. Avoid using the ip do fragment function in the affected API endpoint until the issue is resolved.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Suse
Ubuntu