fkie_cve-2021-47223
Vulnerability from fkie_nvd
Published
2024-05-21 15:15
Modified
2025-02-03 16:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst null pointer dereference This patch fixes a tunnel_dst null pointer dereference due to lockless access in the tunnel egress path. When deleting a vlan tunnel the tunnel_dst pointer is set to NULL without waiting a grace period (i.e. while it's still usable) and packets egressing are dereferencing it without checking. Use READ/WRITE_ONCE to annotate the lockless use of tunnel_id, use RCU for accessing tunnel_dst and make sure it is read only once and checked in the egress path. The dst is already properly RCU protected so we don't need to do anything fancy than to make sure tunnel_id and tunnel_dst are read only once and checked in the egress path.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35dPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166fPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5cPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35dPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7Patch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel 5.13
linux linux_kernel 5.13
linux linux_kernel 5.13
linux linux_kernel 5.13
linux linux_kernel 5.13
linux linux_kernel 5.13


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "32B54D58-21AF-4B0B-B388-EADE824369F7",
                     versionEndExcluding: "4.14.238",
                     versionStartIncluding: "4.11",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F3CAB837-7D38-4934-AD4F-195CEFD754E6",
                     versionEndExcluding: "4.19.196",
                     versionStartIncluding: "4.15",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6267BD4E-BE25-48B5-B850-4B493440DAFA",
                     versionEndExcluding: "5.4.128",
                     versionStartIncluding: "4.20",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "59455D13-A902-42E1-97F7-5ED579777193",
                     versionEndExcluding: "5.10.46",
                     versionStartIncluding: "5.5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "7806E7E5-6D4F-4E18-81C1-79B3C60EE855",
                     versionEndExcluding: "5.12.13",
                     versionStartIncluding: "5.11",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*",
                     matchCriteriaId: "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*",
                     matchCriteriaId: "96AC23B2-D46A-49D9-8203-8E1BEDCA8532",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*",
                     matchCriteriaId: "DA610E30-717C-4700-9F77-A3C9244F3BFD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*",
                     matchCriteriaId: "1ECD33F5-85BE-430B-8F86-8D7BD560311D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*",
                     matchCriteriaId: "CF351855-2437-4CF5-AD7C-BDFA51F27683",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*",
                     matchCriteriaId: "25A855BA-2118-44F2-90EF-EBBB12AF51EF",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix vlan tunnel dst null pointer dereference\n\nThis patch fixes a tunnel_dst null pointer dereference due to lockless\naccess in the tunnel egress path. When deleting a vlan tunnel the\ntunnel_dst pointer is set to NULL without waiting a grace period (i.e.\nwhile it's still usable) and packets egressing are dereferencing it\nwithout checking. Use READ/WRITE_ONCE to annotate the lockless use of\ntunnel_id, use RCU for accessing tunnel_dst and make sure it is read\nonly once and checked in the egress path. The dst is already properly RCU\nprotected so we don't need to do anything fancy than to make sure\ntunnel_id and tunnel_dst are read only once and checked in the egress path.",
      },
      {
         lang: "es",
         value: " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: bridge: corrige la desreferencia del puntero null del túnel vlan dst Este parche corrige una desreferencia del puntero null de Tunnel_dst debido al acceso sin bloqueo en la ruta de salida del túnel. Al eliminar un túnel VLAN, el puntero Tunnel_dst se establece en NULL sin esperar un período de gracia (es decir, mientras aún se puede utilizar) y los paquetes que salen lo desreferencian sin verificarlo. Use READ/WRITE_ONCE para anotar el uso sin bloqueo de Tunnel_id, use RCU para acceder a Tunnel_dst y asegúrese de que se lea solo una vez y se verifique en la ruta de salida. El dst ya está correctamente protegido por la RCU, por lo que no necesitamos hacer nada sofisticado más que asegurarnos de que Tunnel_id y Tunnel_dst se lean solo una vez y se verifiquen en la ruta de salida.",
      },
   ],
   id: "CVE-2021-47223",
   lastModified: "2025-02-03T16:11:14.527",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-05-21T15:15:11.530",
   references: [
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166f",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5c",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35d",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166f",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5c",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35d",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7",
      },
   ],
   sourceIdentifier: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-476",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.