CVE-2021-47224 (GCVE-0-2021-47224)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:19 – Updated: 2026-08-05 08:46
VLAI
Title
net: ll_temac: Make sure to free skb when it is completely used
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: Make sure to free skb when it is completely used With the skb pointer piggy-backed on the TX BD, we have a simple and efficient way to free the skb buffer when the frame has been transmitted. But in order to avoid freeing the skb while there are still fragments from the skb in use, we need to piggy-back on the TX BD of the skb, not the first. Without this, we are doing use-after-free on the DMA side, when the first BD of a multi TX BD packet is seen as completed in xmit_done, and the remaining BDs are still being processed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-31 18:48 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 92744989533cbe85e8057935d230e128810168ce , < 6d120ab4dc39a543c6b63361e1d0541c382900a3 (git)
Affected: 92744989533cbe85e8057935d230e128810168ce , < 019ab7d044d0ebf97e1236bb8935b7809be92358 (git)
Affected: 92744989533cbe85e8057935d230e128810168ce , < e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b (git)
Affected: 92744989533cbe85e8057935d230e128810168ce , < 6aa32217a9a446275440ee8724b1ecaf1838df47 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.31
Unaffected: 0 , < 2.6.31 (semver)
Unaffected: 5.4.128 , ≤ 5.4.* (semver)
Unaffected: 5.10.46 , ≤ 5.10.* (semver)
Unaffected: 5.12.13 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47224",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-31T18:48:29.010008Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T20:41:06.725Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.412Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xilinx/ll_temac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6d120ab4dc39a543c6b63361e1d0541c382900a3",
              "status": "affected",
              "version": "92744989533cbe85e8057935d230e128810168ce",
              "versionType": "git"
            },
            {
              "lessThan": "019ab7d044d0ebf97e1236bb8935b7809be92358",
              "status": "affected",
              "version": "92744989533cbe85e8057935d230e128810168ce",
              "versionType": "git"
            },
            {
              "lessThan": "e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b",
              "status": "affected",
              "version": "92744989533cbe85e8057935d230e128810168ce",
              "versionType": "git"
            },
            {
              "lessThan": "6aa32217a9a446275440ee8724b1ecaf1838df47",
              "status": "affected",
              "version": "92744989533cbe85e8057935d230e128810168ce",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xilinx/ll_temac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.128",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.46",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.13",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ll_temac: Make sure to free skb when it is completely used\n\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\nefficient way to free the skb buffer when the frame has been transmitted.\nBut in order to avoid freeing the skb while there are still fragments from\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\nfirst.\n\nWithout this, we are doing use-after-free on the DMA side, when the first\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\nremaining BDs are still being processed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the ll_temac TX path (temac_start_xmit \u2192 TX IRQ \u2192 temac_start_xmit_done), reached when a local process transmits multi-fragment skbs on a Xilinx LL TEMAC interface with NETIF_F_SG; it is not triggered by parsing remotely injected RX frames.\nAC:L - Any multi-fragment transmit (nr_frags \u003e 0) deterministically stores the skb on the first BD and frees it in xmit_done before remaining fragment BDs are unmapped, so an attacker who sends large/SG traffic reliably hits the DMA use-after-free with no uncontrollable race.\nPR:L - An unprivileged local user can open sockets and send traffic out an already-up TEMAC interface without CAP_NET_ADMIN or init-namespace root, matching other NIC TX-path UAF scores.\nUI:N - Exploitation requires only attacker-generated transmit traffic; no separate victim action such as mounting a filesystem or opening a crafted file is needed.\nS:U - Impact stays within the host kernel\u0027s networking/DMA authority (premature skb free and DMA-after-free of TX fragments) and does not cross a VM, IOMMU isolation, or other security boundary.\nC:H - Freeing the skb while fragment pages remain DMA-mapped lets the engine read recycled page contents and can disclose them on the wire; per UAF guidance this is High confidentiality impact.\nI:H - Premature free/unmap of an in-flight multi-BD skb is a reclaimable DMA/heap use-after-free under attacker-driven TX; per UAF guidance this class enables heap corruption and control-flow hijack primitives.\nA:H - DMA-after-free of still-mapped TX fragments can IOMMU-fault or oops the kernel, and any use-after-free scores Availability High even when not fully turned into code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:48.857Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47"
        }
      ],
      "title": "net: ll_temac: Make sure to free skb when it is completely used",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47224",
    "datePublished": "2024-05-21T14:19:29.542Z",
    "dateReserved": "2024-04-10T18:59:19.529Z",
    "dateUpdated": "2026-08-05T08:46:48.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47224",
      "date": "2026-08-13",
      "epss": "0.00232",
      "percentile": "0.14204"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ll_temac: Make sure to free skb when it is completely used\\n\\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\\nefficient way to free the skb buffer when the frame has been transmitted.\\nBut in order to avoid freeing the skb while there are still fragments from\\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\\nfirst.\\n\\nWithout this, we are doing use-after-free on the DMA side, when the first\\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\\nremaining BDs are still being processed.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: net:ll_temac: Aseg\\u00farate de liberar skb cuando est\\u00e9 completamente utilizado. Con el puntero skb acoplado en la BD TX, tenemos una forma sencilla y eficaz de liberar el buffer skb. cuando la trama ha sido transmitida. Pero para evitar liberar el skb mientras todav\\u00eda hay fragmentos del skb en uso, debemos aprovechar el BD TX del skb, no el primero. Sin esto, estamos haciendo use after free en el lado DMA, cuando el primer BD de un paquete BD de transmisi\\u00f3n m\\u00faltiple se considera completado en xmit_done y los BD restantes todav\\u00eda se est\\u00e1n procesando.\"}]",
      "id": "CVE-2021-47224",
      "lastModified": "2024-11-21T06:35:39.623",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 6.2, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.5, \"impactScore\": 3.6}]}",
      "published": "2024-05-21T15:15:11.687",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47224\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:11.687\",\"lastModified\":\"2026-08-04T10:16:53.420\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ll_temac: Make sure to free skb when it is completely used\\n\\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\\nefficient way to free the skb buffer when the frame has been transmitted.\\nBut in order to avoid freeing the skb while there are still fragments from\\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\\nfirst.\\n\\nWithout this, we are doing use-after-free on the DMA side, when the first\\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\\nremaining BDs are still being processed.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: net:ll_temac: Aseg\u00farate de liberar skb cuando est\u00e9 completamente utilizado. Con el puntero skb acoplado en la BD TX, tenemos una forma sencilla y eficaz de liberar el buffer skb. cuando la trama ha sido transmitida. Pero para evitar liberar el skb mientras todav\u00eda hay fragmentos del skb en uso, debemos aprovechar el BD TX del skb, no el primero. Sin esto, estamos haciendo use after free en el lado DMA, cuando el primer BD de un paquete BD de transmisi\u00f3n m\u00faltiple se considera completado en xmit_done y los BD restantes todav\u00eda se est\u00e1n procesando.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/xilinx/ll_temac_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"92744989533cbe85e8057935d230e128810168ce\",\"lessThan\":\"6d120ab4dc39a543c6b63361e1d0541c382900a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"92744989533cbe85e8057935d230e128810168ce\",\"lessThan\":\"019ab7d044d0ebf97e1236bb8935b7809be92358\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"92744989533cbe85e8057935d230e128810168ce\",\"lessThan\":\"e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"92744989533cbe85e8057935d230e128810168ce\",\"lessThan\":\"6aa32217a9a446275440ee8724b1ecaf1838df47\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/xilinx/ll_temac_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.31\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.31\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.128\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.46\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.13\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-31T18:48:29.010008Z\",\"id\":\"CVE-2021-47224\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.128\",\"matchCriteriaId\":\"3F3CD510-C528-4ECA-AD21-A4F1A661CA40\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.46\",\"matchCriteriaId\":\"59455D13-A902-42E1-97F7-5ED579777193\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.13\",\"matchCriteriaId\":\"7806E7E5-6D4F-4E18-81C1-79B3C60EE855\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA610E30-717C-4700-9F77-A3C9244F3BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1ECD33F5-85BE-430B-8F86-8D7BD560311D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF351855-2437-4CF5-AD7C-BDFA51F27683\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"25A855BA-2118-44F2-90EF-EBBB12AF51EF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:36:37+00:00",
      "cve": "CVE-2021-47224",
      "id": "CVE-2021-47224",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ll_temac: Make sure to free skb when it is completely used",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47224.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T17:34:57Z",
      "cve": "CVE-2021-47224",
      "id": "CVE-2021-47224",
      "initial_release_date": "2024-05-23T03:05:39Z",
      "product_status:known_affected": "55",
      "product_status:known_not_affected": "275",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47224",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47224.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.412Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47224\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-31T18:48:29.010008Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-31T18:48:32.403Z\"}}], \"cna\": {\"title\": \"net: ll_temac: Make sure to free skb when it is completely used\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in the ll_temac TX path (temac_start_xmit \\u2192 TX IRQ \\u2192 temac_start_xmit_done), reached when a local process transmits multi-fragment skbs on a Xilinx LL TEMAC interface with NETIF_F_SG; it is not triggered by parsing remotely injected RX frames.\\nAC:L - Any multi-fragment transmit (nr_frags \u003e 0) deterministically stores the skb on the first BD and frees it in xmit_done before remaining fragment BDs are unmapped, so an attacker who sends large/SG traffic reliably hits the DMA use-after-free with no uncontrollable race.\\nPR:L - An unprivileged local user can open sockets and send traffic out an already-up TEMAC interface without CAP_NET_ADMIN or init-namespace root, matching other NIC TX-path UAF scores.\\nUI:N - Exploitation requires only attacker-generated transmit traffic; no separate victim action such as mounting a filesystem or opening a crafted file is needed.\\nS:U - Impact stays within the host kernel\u0027s networking/DMA authority (premature skb free and DMA-after-free of TX fragments) and does not cross a VM, IOMMU isolation, or other security boundary.\\nC:H - Freeing the skb while fragment pages remain DMA-mapped lets the engine read recycled page contents and can disclose them on the wire; per UAF guidance this is High confidentiality impact.\\nI:H - Premature free/unmap of an in-flight multi-BD skb is a reclaimable DMA/heap use-after-free under attacker-driven TX; per UAF guidance this class enables heap corruption and control-flow hijack primitives.\\nA:H - DMA-after-free of still-mapped TX fragments can IOMMU-fault or oops the kernel, and any use-after-free scores Availability High even when not fully turned into code execution.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"92744989533cbe85e8057935d230e128810168ce\", \"lessThan\": \"6d120ab4dc39a543c6b63361e1d0541c382900a3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"92744989533cbe85e8057935d230e128810168ce\", \"lessThan\": \"019ab7d044d0ebf97e1236bb8935b7809be92358\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"92744989533cbe85e8057935d230e128810168ce\", \"lessThan\": \"e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"92744989533cbe85e8057935d230e128810168ce\", \"lessThan\": \"6aa32217a9a446275440ee8724b1ecaf1838df47\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/xilinx/ll_temac_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.31\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.31\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.128\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/xilinx/ll_temac_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3\"}, {\"url\": \"https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358\"}, {\"url\": \"https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b\"}, {\"url\": \"https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ll_temac: Make sure to free skb when it is completely used\\n\\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\\nefficient way to free the skb buffer when the frame has been transmitted.\\nBut in order to avoid freeing the skb while there are still fragments from\\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\\nfirst.\\n\\nWithout this, we are doing use-after-free on the DMA side, when the first\\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\\nremaining BDs are still being processed.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.128\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.46\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.13\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"2.6.31\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:48.857Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47224\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:48.857Z\", \"dateReserved\": \"2024-04-10T18:59:19.529Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:19:29.542Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.