CVE-2021-47223
Vulnerability from cvelistv5
Published
2024-05-21 14:19
Modified
2024-12-19 07:37
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst null pointer dereference This patch fixes a tunnel_dst null pointer dereference due to lockless access in the tunnel egress path. When deleting a vlan tunnel the tunnel_dst pointer is set to NULL without waiting a grace period (i.e. while it's still usable) and packets egressing are dereferencing it without checking. Use READ/WRITE_ONCE to annotate the lockless use of tunnel_id, use RCU for accessing tunnel_dst and make sure it is read only once and checked in the egress path. The dst is already properly RCU protected so we don't need to do anything fancy than to make sure tunnel_id and tunnel_dst are read only once and checked in the egress path.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166f
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5c
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35d
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7
Impacted products
Vendor Product Version
Linux Linux Version: 4.11
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47223",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T18:10:14.404752Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:02.341Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.485Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_private.h",
            "net/bridge/br_vlan_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad7feefe7164892db424c45687472db803d87f79",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            },
            {
              "lessThan": "24a6e55f17aa123bc1fc54b7d3c410b41bc16530",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            },
            {
              "lessThan": "a2241e62f6b4a774d8a92048fdf59c45f6c2fe5c",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            },
            {
              "lessThan": "fe0448a3fad365a747283a00a1d1ad5e8d6675b7",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            },
            {
              "lessThan": "abb02e05cb1c0a30dd873a29f33bc092067dc35d",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            },
            {
              "lessThan": "58e2071742e38f29f051b709a5cca014ba51166f",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_private.h",
            "net/bridge/br_vlan_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix vlan tunnel dst null pointer dereference\n\nThis patch fixes a tunnel_dst null pointer dereference due to lockless\naccess in the tunnel egress path. When deleting a vlan tunnel the\ntunnel_dst pointer is set to NULL without waiting a grace period (i.e.\nwhile it\u0027s still usable) and packets egressing are dereferencing it\nwithout checking. Use READ/WRITE_ONCE to annotate the lockless use of\ntunnel_id, use RCU for accessing tunnel_dst and make sure it is read\nonly once and checked in the egress path. The dst is already properly RCU\nprotected so we don\u0027t need to do anything fancy than to make sure\ntunnel_id and tunnel_dst are read only once and checked in the egress path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T07:37:42.436Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79"
        },
        {
          "url": "https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35d"
        },
        {
          "url": "https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166f"
        }
      ],
      "title": "net: bridge: fix vlan tunnel dst null pointer dereference",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47223",
    "datePublished": "2024-05-21T14:19:28.882Z",
    "dateReserved": "2024-04-10T18:59:19.529Z",
    "dateUpdated": "2024-12-19T07:37:42.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47223\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:11.530\",\"lastModified\":\"2024-11-21T06:35:39.510\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bridge: fix vlan tunnel dst null pointer dereference\\n\\nThis patch fixes a tunnel_dst null pointer dereference due to lockless\\naccess in the tunnel egress path. When deleting a vlan tunnel the\\ntunnel_dst pointer is set to NULL without waiting a grace period (i.e.\\nwhile it\u0027s still usable) and packets egressing are dereferencing it\\nwithout checking. Use READ/WRITE_ONCE to annotate the lockless use of\\ntunnel_id, use RCU for accessing tunnel_dst and make sure it is read\\nonly once and checked in the egress path. The dst is already properly RCU\\nprotected so we don\u0027t need to do anything fancy than to make sure\\ntunnel_id and tunnel_dst are read only once and checked in the egress path.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: bridge: corrige la desreferencia del puntero null del t\u00fanel vlan dst Este parche corrige una desreferencia del puntero null de Tunnel_dst debido al acceso sin bloqueo en la ruta de salida del t\u00fanel. Al eliminar un t\u00fanel VLAN, el puntero Tunnel_dst se establece en NULL sin esperar un per\u00edodo de gracia (es decir, mientras a\u00fan se puede utilizar) y los paquetes que salen lo desreferencian sin verificarlo. Use READ/WRITE_ONCE para anotar el uso sin bloqueo de Tunnel_id, use RCU para acceder a Tunnel_dst y aseg\u00farese de que se lea solo una vez y se verifique en la ruta de salida. El dst ya est\u00e1 correctamente protegido por la RCU, por lo que no necesitamos hacer nada sofisticado m\u00e1s que asegurarnos de que Tunnel_id y Tunnel_dst se lean solo una vez y se verifiquen en la ruta de salida.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.