CVE-2021-47137 (GCVE-0-2021-47137)

Vulnerability from cvelistv5 – Published: 2024-03-25 09:07 – Updated: 2026-08-05 08:46
VLAI
Title
net: lantiq: fix memory corruption in RX ring
Summary
In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corruption in RX ring In a situation where memory allocation or dma mapping fails, an invalid address is programmed into the descriptor. This can lead to memory corruption. If the memory allocation fails, DMA should reuse the previous skb and mapping and drop the packet. This patch also increments rx drop counter.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fe1a56420cf2ec28c8eceef672b87de0bbe1a260 , < 8bb1077448d43a871ed667520763e3b9f9b7975d (git)
Affected: fe1a56420cf2ec28c8eceef672b87de0bbe1a260 , < 5ac72351655f8b033a2935646f53b7465c903418 (git)
Affected: fe1a56420cf2ec28c8eceef672b87de0bbe1a260 , < 46dd4abced3cb2c912916f4a5353e0927db0c4a2 (git)
Affected: fe1a56420cf2ec28c8eceef672b87de0bbe1a260 , < c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20 (git)
Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 5.4.124 , ≤ 5.4.* (semver)
Unaffected: 5.10.42 , ≤ 5.10.* (semver)
Unaffected: 5.12.9 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
linux linux_kernel Affected: fe1a56420cf2 , < 8bb1077448d4 (git)
Affected: fe1a56420cf2 , < 5ac72351655f (git)
Affected: fe1a56420cf2 , < 46dd4abced3c (git)
Affected: fe1a56420cf2 , < c7718ee96dbc (git)
Affected: 4.20
Affected: 0 , ≤ 4.20 (semver)
Affected: 5.4.124 , ≤ 5.4* (semver)
Affected: 5.10.42 , ≤ 5.10* (semver)
Affected: 5.12.9 , ≤ 5.12* (semver)
Affected: 5.13 , ≤ * (semver)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "8bb1077448d4",
                "status": "affected",
                "version": "fe1a56420cf2",
                "versionType": "git"
              },
              {
                "lessThan": "5ac72351655f",
                "status": "affected",
                "version": "fe1a56420cf2",
                "versionType": "git"
              },
              {
                "lessThan": "46dd4abced3c",
                "status": "affected",
                "version": "fe1a56420cf2",
                "versionType": "git"
              },
              {
                "lessThan": "c7718ee96dbc",
                "status": "affected",
                "version": "fe1a56420cf2",
                "versionType": "git"
              },
              {
                "status": "affected",
                "version": "4.20"
              },
              {
                "lessThanOrEqual": "4.20",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.4*",
                "status": "affected",
                "version": "5.4.124",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10*",
                "status": "affected",
                "version": "5.10.42",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.12*",
                "status": "affected",
                "version": "5.12.9",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "affected",
                "version": "5.13",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47137",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-25T17:15:32.931685Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T16:22:44.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.977Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/lantiq_xrx200.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8bb1077448d43a871ed667520763e3b9f9b7975d",
              "status": "affected",
              "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260",
              "versionType": "git"
            },
            {
              "lessThan": "5ac72351655f8b033a2935646f53b7465c903418",
              "status": "affected",
              "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260",
              "versionType": "git"
            },
            {
              "lessThan": "46dd4abced3cb2c912916f4a5353e0927db0c4a2",
              "status": "affected",
              "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260",
              "versionType": "git"
            },
            {
              "lessThan": "c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20",
              "status": "affected",
              "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/lantiq_xrx200.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.124",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.42",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.9",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lantiq: fix memory corruption in RX ring\n\nIn a situation where memory allocation or dma mapping fails, an\ninvalid address is programmed into the descriptor. This can lead\nto memory corruption. If the memory allocation fails, DMA should\nreuse the previous skb and mapping and drop the packet. This patch\nalso increments rx drop counter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached from the XRX200 PMAC receive path (DMA IRQ \u2192 NAPI \u2192 xrx200_poll_rx \u2192 xrx200_hw_receive \u2192 xrx200_alloc_skb) while processing inbound frames; on typical VRX200 gateway deployments this CPU port handles WAN/LAN switch traffic, so a remote peer can trigger it by sending packets.\nAC:L - An attacker can flood traffic to induce memory pressure on constrained VRX200 routers so netdev_alloc_skb or dma_map_single fails during RX refill; once that happens the invalid-descriptor/UAF or NULL-deref path is deterministic, and under the uncertainty rule allocation/mapping failure is treated as low complexity.\nPR:N - No local account or capability is required; any host that can deliver frames to the interface causes RX ring refill with no authentication gate on this path.\nUI:N - Exploitation requires only attacker-sent packets; no victim action such as mounting a filesystem or opening a device is needed.\nS:U - Corruption and crashes occur in the host kernel\u2019s ethernet driver/DMA path within the same security authority; this is not a VM escape or IOMMU/sandbox boundary crossing.\nC:H - On DMA mapping failure the driver programs DMA_MAPPING_ERROR into the RX descriptor and frees the new skb while leaving a dangling ring pointer, yielding a use-after-free plus DMA of attacker-controlled packet bytes to an invalid address\u2014memory corruption that can be leveraged for kernel information disclosure.\nI:H - Programming an invalid RX DMA address lets hardware write attacker-controlled frame contents into unintended memory, and the dangling freed skb pointer is a classic UAF write/control-flow primitive under kernel memory-corruption guidance.\nA:H - Failed refill leaves a NULL or dangling skb in the RX ring so a subsequent packet causes NULL deref/UAF oops, and invalid DMA addresses can bus-error or panic the kernel, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:17.530Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418"
        },
        {
          "url": "https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20"
        }
      ],
      "title": "net: lantiq: fix memory corruption in RX ring",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47137",
    "datePublished": "2024-03-25T09:07:36.778Z",
    "dateReserved": "2024-03-04T18:12:48.841Z",
    "dateUpdated": "2026-08-05T08:46:17.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47137",
      "date": "2026-08-09",
      "epss": "0.00597",
      "percentile": "0.45326"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: lantiq: fix memory corruption in RX ring\\n\\nIn a situation where memory allocation or dma mapping fails, an\\ninvalid address is programmed into the descriptor. This can lead\\nto memory corruption. If the memory allocation fails, DMA should\\nreuse the previous skb and mapping and drop the packet. This patch\\nalso increments rx drop counter.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: net: lantiq: corrige la corrupci\\u00f3n de la memoria en el anillo RX En una situaci\\u00f3n en la que falla la asignaci\\u00f3n de memoria o el mapeo dma, se programa una direcci\\u00f3n no v\\u00e1lida en el descriptor. Esto puede provocar da\\u00f1os en la memoria. Si la asignaci\\u00f3n de memoria falla, DMA deber\\u00eda reutilizar el skb y el mapeo anteriores y descartar el paquete. Este parche tambi\\u00e9n incrementa el contador de ca\\u00eddas de rx.\"}]",
      "id": "CVE-2021-47137",
      "lastModified": "2024-11-21T06:35:28.317",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-03-25T09:15:08.240",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47137\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-25T09:15:08.240\",\"lastModified\":\"2026-08-04T10:16:48.443\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: lantiq: fix memory corruption in RX ring\\n\\nIn a situation where memory allocation or dma mapping fails, an\\ninvalid address is programmed into the descriptor. This can lead\\nto memory corruption. If the memory allocation fails, DMA should\\nreuse the previous skb and mapping and drop the packet. This patch\\nalso increments rx drop counter.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net: lantiq: corrige la corrupci\u00f3n de la memoria en el anillo RX En una situaci\u00f3n en la que falla la asignaci\u00f3n de memoria o el mapeo dma, se programa una direcci\u00f3n no v\u00e1lida en el descriptor. Esto puede provocar da\u00f1os en la memoria. Si la asignaci\u00f3n de memoria falla, DMA deber\u00eda reutilizar el skb y el mapeo anteriores y descartar el paquete. Este parche tambi\u00e9n incrementa el contador de ca\u00eddas de rx.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/lantiq_xrx200.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fe1a56420cf2ec28c8eceef672b87de0bbe1a260\",\"lessThan\":\"8bb1077448d43a871ed667520763e3b9f9b7975d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1a56420cf2ec28c8eceef672b87de0bbe1a260\",\"lessThan\":\"5ac72351655f8b033a2935646f53b7465c903418\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1a56420cf2ec28c8eceef672b87de0bbe1a260\",\"lessThan\":\"46dd4abced3cb2c912916f4a5353e0927db0c4a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1a56420cf2ec28c8eceef672b87de0bbe1a260\",\"lessThan\":\"c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/lantiq_xrx200.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.124\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.42\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.9\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"fe1a56420cf2\",\"lessThan\":\"8bb1077448d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1a56420cf2\",\"lessThan\":\"5ac72351655f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1a56420cf2\",\"lessThan\":\"46dd4abced3c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1a56420cf2\",\"lessThan\":\"c7718ee96dbc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThanOrEqual\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.124\",\"lessThanOrEqual\":\"5.4*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.42\",\"lessThanOrEqual\":\"5.10*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.12.9\",\"lessThanOrEqual\":\"5.12*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-03-25T17:15:32.931685Z\",\"id\":\"CVE-2021-47137\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.124\",\"matchCriteriaId\":\"06FE0F99-F7A9-462A-8355-30E2EDA9826B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.42\",\"matchCriteriaId\":\"C3E7E799-1C8A-45FB-9E07-4731996144C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.9\",\"matchCriteriaId\":\"2C8A1D02-81A7-44E5-ACFD-CC6A6694F930\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA610E30-717C-4700-9F77-A3C9244F3BFD\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:06:41+00:00",
      "cve": "CVE-2021-47137",
      "id": "CVE-2021-47137",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: lantiq: fix memory corruption in RX ring",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47137.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T02:08:06Z",
      "cve": "CVE-2021-47137",
      "id": "CVE-2021-47137",
      "initial_release_date": "2024-03-26T03:49:43Z",
      "product_status:known_affected": "388",
      "product_status:known_not_affected": "256",
      "product_status:recommended": "91",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47137",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47137.json",
      "version": "38"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.977Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47137\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-25T17:15:32.931685Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"fe1a56420cf2\", \"lessThan\": \"8bb1077448d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe1a56420cf2\", \"lessThan\": \"5ac72351655f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe1a56420cf2\", \"lessThan\": \"46dd4abced3c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe1a56420cf2\", \"lessThan\": \"c7718ee96dbc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.20\"}, {\"status\": \"affected\", \"version\": \"5.4.124\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4*\"}, {\"status\": \"affected\", \"version\": \"5.10.42\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10*\"}, {\"status\": \"affected\", \"version\": \"5.12.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12*\"}, {\"status\": \"affected\", \"version\": \"5.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"*\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:19.437Z\"}}], \"cna\": {\"title\": \"net: lantiq: fix memory corruption in RX ring\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The bug is reached from the XRX200 PMAC receive path (DMA IRQ \\u2192 NAPI \\u2192 xrx200_poll_rx \\u2192 xrx200_hw_receive \\u2192 xrx200_alloc_skb) while processing inbound frames; on typical VRX200 gateway deployments this CPU port handles WAN/LAN switch traffic, so a remote peer can trigger it by sending packets.\\nAC:L - An attacker can flood traffic to induce memory pressure on constrained VRX200 routers so netdev_alloc_skb or dma_map_single fails during RX refill; once that happens the invalid-descriptor/UAF or NULL-deref path is deterministic, and under the uncertainty rule allocation/mapping failure is treated as low complexity.\\nPR:N - No local account or capability is required; any host that can deliver frames to the interface causes RX ring refill with no authentication gate on this path.\\nUI:N - Exploitation requires only attacker-sent packets; no victim action such as mounting a filesystem or opening a device is needed.\\nS:U - Corruption and crashes occur in the host kernel\\u2019s ethernet driver/DMA path within the same security authority; this is not a VM escape or IOMMU/sandbox boundary crossing.\\nC:H - On DMA mapping failure the driver programs DMA_MAPPING_ERROR into the RX descriptor and frees the new skb while leaving a dangling ring pointer, yielding a use-after-free plus DMA of attacker-controlled packet bytes to an invalid address\\u2014memory corruption that can be leveraged for kernel information disclosure.\\nI:H - Programming an invalid RX DMA address lets hardware write attacker-controlled frame contents into unintended memory, and the dangling freed skb pointer is a classic UAF write/control-flow primitive under kernel memory-corruption guidance.\\nA:H - Failed refill leaves a NULL or dangling skb in the RX ring so a subsequent packet causes NULL deref/UAF oops, and invalid DMA addresses can bus-error or panic the kernel, fully denying availability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fe1a56420cf2ec28c8eceef672b87de0bbe1a260\", \"lessThan\": \"8bb1077448d43a871ed667520763e3b9f9b7975d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe1a56420cf2ec28c8eceef672b87de0bbe1a260\", \"lessThan\": \"5ac72351655f8b033a2935646f53b7465c903418\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe1a56420cf2ec28c8eceef672b87de0bbe1a260\", \"lessThan\": \"46dd4abced3cb2c912916f4a5353e0927db0c4a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe1a56420cf2ec28c8eceef672b87de0bbe1a260\", \"lessThan\": \"c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/lantiq_xrx200.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.124\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.42\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/lantiq_xrx200.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d\"}, {\"url\": \"https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418\"}, {\"url\": \"https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2\"}, {\"url\": \"https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: lantiq: fix memory corruption in RX ring\\n\\nIn a situation where memory allocation or dma mapping fails, an\\ninvalid address is programmed into the descriptor. This can lead\\nto memory corruption. If the memory allocation fails, DMA should\\nreuse the previous skb and mapping and drop the packet. This patch\\nalso increments rx drop counter.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.124\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.42\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.9\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"4.20\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:17.530Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47137\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:17.530Z\", \"dateReserved\": \"2024-03-04T18:12:48.841Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-25T09:07:36.778Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.