CVE-2021-47036 (GCVE-0-2021-47036)

Vulnerability from cvelistv5 – Published: 2024-02-28 08:13 – Updated: 2026-08-05 08:45
VLAI
Title
udp: skip L4 aggregation for UDP tunnel packets
Summary
In the Linux kernel, the following vulnerability has been resolved: udp: skip L4 aggregation for UDP tunnel packets If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there are UDP tunnels available in the system, udp_gro_receive() could end-up doing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at the outer UDP tunnel level for packets effectively carrying and UDP tunnel header. That could cause inner protocol corruption. If e.g. the relevant packets carry a vxlan header, different vxlan ids will be ignored/ aggregated to the same GSO packet. Inner headers will be ignored, too, so that e.g. TCP over vxlan push packets will be held in the GRO engine till the next flush, etc. Just skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the current packet could land in a UDP tunnel, and let udp_gro_receive() do GRO via udp_sk(sk)->gro_receive. The check implemented in this patch is broader than what is strictly needed, as the existing UDP tunnel could be e.g. configured on top of a different device: we could end-up skipping GRO at-all for some packets. Anyhow, that is a very thin corner case and covering it will add quite a bit of complexity. v1 -> v2: - hopefully clarify the commit message
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-28 20:31 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9fd1ff5d2ac7181844735806b0a703c942365291 , < 450687386cd16d081b58cd7a342acff370a96078 (git)
Affected: 9fd1ff5d2ac7181844735806b0a703c942365291 , < 18f25dc399901426dff61e676ba603ff52c666f7 (git)
Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.12.4 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47036",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-28T20:31:59.928019Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:33.835Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.049Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/450687386cd16d081b58cd7a342acff370a96078"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/18f25dc399901426dff61e676ba603ff52c666f7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/udp_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "450687386cd16d081b58cd7a342acff370a96078",
              "status": "affected",
              "version": "9fd1ff5d2ac7181844735806b0a703c942365291",
              "versionType": "git"
            },
            {
              "lessThan": "18f25dc399901426dff61e676ba603ff52c666f7",
              "status": "affected",
              "version": "9fd1ff5d2ac7181844735806b0a703c942365291",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/udp_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: skip L4 aggregation for UDP tunnel packets\n\nIf NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there\nare UDP tunnels available in the system, udp_gro_receive() could end-up\ndoing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at\nthe outer UDP tunnel level for packets effectively carrying and UDP\ntunnel header.\n\nThat could cause inner protocol corruption. If e.g. the relevant\npackets carry a vxlan header, different vxlan ids will be ignored/\naggregated to the same GSO packet. Inner headers will be ignored, too,\nso that e.g. TCP over vxlan push packets will be held in the GRO\nengine till the next flush, etc.\n\nJust skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the\ncurrent packet could land in a UDP tunnel, and let udp_gro_receive()\ndo GRO via udp_sk(sk)-\u003egro_receive.\n\nThe check implemented in this patch is broader than what is strictly\nneeded, as the existing UDP tunnel could be e.g. configured on top of\na different device: we could end-up skipping GRO at-all for some packets.\n\nAnyhow, that is a very thin corner case and covering it will add quite\na bit of complexity.\n\nv1 -\u003e v2:\n - hopefully clarify the commit message"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in udp_gro_receive()/udp4_gro_receive on the NAPI GRO receive path for inbound UDP packets, so a remote peer triggers it by sending UDP/VXLAN/Geneve traffic to a host with UDP tunnels; no local syscall is required.\nAC:L - With rx-gro-list or rx-udp-gro-forwarding enabled (the vulnerable configuration assumed for Base scoring), an attacker can reliably force incorrect L4/fraglist aggregation by sending packets that share the outer UDP flow while differing in inner tunnel headers; no race or uncontrolled memory layout is required.\nPR:N - Packet processing occurs in the kernel networking stack before any application authentication; sending UDP packets to the tunnel port needs no account or capability on the target.\nUI:N - Exploitation is fully driven by attacker-sent packets against an already-configured UDP tunnel endpoint; no victim user action is required.\nS:U - Impact stays within the host kernel network stack and tunnel datapath under the same OS security authority; this is not a VM/IOMMU/sandbox escape.\nC:H - Incorrect outer-UDP aggregation ignores VXLAN/Geneve identifiers and can merge packets from different tunnel namespaces into one GSO unit, enabling cross-tenant/cross-VNI exposure of encapsulated payloads in multi-tenant overlay deployments.\nI:H - The fix documents inner protocol corruption: different VXLAN IDs are aggregated, inner headers are ignored, and tunnel/TCP streams are rewritten into incorrect GSO packets, which is attacker-influenced corruption of network data integrity.\nA:H - Mis-aggregation holds and corrupts tunnel traffic (including TCP-over-VXLAN delayed until GRO flush) and can produce malformed GSO/fraglist skbs on the tunnel receive path, denying overlay service and aligning with the related GRO-into-tunnel crash class."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:39.890Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/450687386cd16d081b58cd7a342acff370a96078"
        },
        {
          "url": "https://git.kernel.org/stable/c/18f25dc399901426dff61e676ba603ff52c666f7"
        }
      ],
      "title": "udp: skip L4 aggregation for UDP tunnel packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47036",
    "datePublished": "2024-02-28T08:13:44.034Z",
    "dateReserved": "2024-02-27T18:42:55.965Z",
    "dateUpdated": "2026-08-05T08:45:39.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47036",
      "date": "2026-08-16",
      "epss": "0.00531",
      "percentile": "0.42414"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.6\", \"versionEndExcluding\": \"5.12.4\", \"matchCriteriaId\": \"2FAD935D-A5F1-4985-B35B-998850A9C49D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nudp: skip L4 aggregation for UDP tunnel packets\\n\\nIf NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there\\nare UDP tunnels available in the system, udp_gro_receive() could end-up\\ndoing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at\\nthe outer UDP tunnel level for packets effectively carrying and UDP\\ntunnel header.\\n\\nThat could cause inner protocol corruption. If e.g. the relevant\\npackets carry a vxlan header, different vxlan ids will be ignored/\\naggregated to the same GSO packet. Inner headers will be ignored, too,\\nso that e.g. TCP over vxlan push packets will be held in the GRO\\nengine till the next flush, etc.\\n\\nJust skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the\\ncurrent packet could land in a UDP tunnel, and let udp_gro_receive()\\ndo GRO via udp_sk(sk)-\u003egro_receive.\\n\\nThe check implemented in this patch is broader than what is strictly\\nneeded, as the existing UDP tunnel could be e.g. configured on top of\\na different device: we could end-up skipping GRO at-all for some packets.\\n\\nAnyhow, that is a very thin corner case and covering it will add quite\\na bit of complexity.\\n\\nv1 -\u003e v2:\\n - hopefully clarify the commit message\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: udp: omitir la agregaci\\u00f3n L4 para paquetes de t\\u00fanel UDP Si NETIF_F_GRO_FRAGLIST o NETIF_F_GRO_UDP_FWD est\\u00e1n habilitados y hay t\\u00faneles UDP disponibles en el sistema, udp_gro_receive() podr\\u00eda terminar realizando la agregaci\\u00f3n L4 (ya sea SKB_GSO_UDP_L4 o SKB_GSO_FRAGLIST) en el nivel del t\\u00fanel UDP externo para paquetes que transportan efectivamente un encabezado de t\\u00fanel UDP. Eso podr\\u00eda causar corrupci\\u00f3n del protocolo interno. Si, por ejemplo, los paquetes relevantes llevan un encabezado vxlan, se ignorar\\u00e1n/agregar\\u00e1n diferentes ID de vxlan al mismo paquete GSO. Los encabezados internos tambi\\u00e9n se ignorar\\u00e1n, de modo que, por ejemplo, los paquetes push TCP sobre vxlan se mantendr\\u00e1n en el motor GRO hasta el pr\\u00f3ximo lavado, etc. Simplemente omita la ruta de c\\u00f3digo SKB_GSO_UDP_L4 y SKB_GSO_FRAGLIST si el paquete actual podr\\u00eda aterrizar en un t\\u00fanel UDP, y deje que udp_gro_receive() haga GRO a trav\\u00e9s de udp_sk(sk)-\u0026gt;gro_receive. La verificaci\\u00f3n implementada en este parche es m\\u00e1s amplia de lo estrictamente necesario, ya que el t\\u00fanel UDP existente podr\\u00eda configurarse, por ejemplo, encima de un dispositivo diferente: podr\\u00edamos terminar omitiendo GRO para algunos paquetes. De todos modos, se trata de una carcasa de esquina muy delgada y cubrirla agregar\\u00e1 bastante complejidad. v1 -\u0026gt; v2: - con suerte aclarar el mensaje de confirmaci\\u00f3n\"}]",
      "id": "CVE-2021-47036",
      "lastModified": "2025-01-10T18:25:11.710",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-02-28T09:15:39.800",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/18f25dc399901426dff61e676ba603ff52c666f7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/450687386cd16d081b58cd7a342acff370a96078\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/18f25dc399901426dff61e676ba603ff52c666f7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/450687386cd16d081b58cd7a342acff370a96078\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47036\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-02-28T09:15:39.800\",\"lastModified\":\"2026-08-04T10:16:42.340\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nudp: skip L4 aggregation for UDP tunnel packets\\n\\nIf NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there\\nare UDP tunnels available in the system, udp_gro_receive() could end-up\\ndoing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at\\nthe outer UDP tunnel level for packets effectively carrying and UDP\\ntunnel header.\\n\\nThat could cause inner protocol corruption. If e.g. the relevant\\npackets carry a vxlan header, different vxlan ids will be ignored/\\naggregated to the same GSO packet. Inner headers will be ignored, too,\\nso that e.g. TCP over vxlan push packets will be held in the GRO\\nengine till the next flush, etc.\\n\\nJust skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the\\ncurrent packet could land in a UDP tunnel, and let udp_gro_receive()\\ndo GRO via udp_sk(sk)-\u003egro_receive.\\n\\nThe check implemented in this patch is broader than what is strictly\\nneeded, as the existing UDP tunnel could be e.g. configured on top of\\na different device: we could end-up skipping GRO at-all for some packets.\\n\\nAnyhow, that is a very thin corner case and covering it will add quite\\na bit of complexity.\\n\\nv1 -\u003e v2:\\n - hopefully clarify the commit message\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: udp: omitir la agregaci\u00f3n L4 para paquetes de t\u00fanel UDP Si NETIF_F_GRO_FRAGLIST o NETIF_F_GRO_UDP_FWD est\u00e1n habilitados y hay t\u00faneles UDP disponibles en el sistema, udp_gro_receive() podr\u00eda terminar realizando la agregaci\u00f3n L4 (ya sea SKB_GSO_UDP_L4 o SKB_GSO_FRAGLIST) en el nivel del t\u00fanel UDP externo para paquetes que transportan efectivamente un encabezado de t\u00fanel UDP. Eso podr\u00eda causar corrupci\u00f3n del protocolo interno. Si, por ejemplo, los paquetes relevantes llevan un encabezado vxlan, se ignorar\u00e1n/agregar\u00e1n diferentes ID de vxlan al mismo paquete GSO. Los encabezados internos tambi\u00e9n se ignorar\u00e1n, de modo que, por ejemplo, los paquetes push TCP sobre vxlan se mantendr\u00e1n en el motor GRO hasta el pr\u00f3ximo lavado, etc. Simplemente omita la ruta de c\u00f3digo SKB_GSO_UDP_L4 y SKB_GSO_FRAGLIST si el paquete actual podr\u00eda aterrizar en un t\u00fanel UDP, y deje que udp_gro_receive() haga GRO a trav\u00e9s de udp_sk(sk)-\u0026gt;gro_receive. La verificaci\u00f3n implementada en este parche es m\u00e1s amplia de lo estrictamente necesario, ya que el t\u00fanel UDP existente podr\u00eda configurarse, por ejemplo, encima de un dispositivo diferente: podr\u00edamos terminar omitiendo GRO para algunos paquetes. De todos modos, se trata de una carcasa de esquina muy delgada y cubrirla agregar\u00e1 bastante complejidad. v1 -\u0026gt; v2: - con suerte aclarar el mensaje de confirmaci\u00f3n\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/udp_offload.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9fd1ff5d2ac7181844735806b0a703c942365291\",\"lessThan\":\"450687386cd16d081b58cd7a342acff370a96078\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9fd1ff5d2ac7181844735806b0a703c942365291\",\"lessThan\":\"18f25dc399901426dff61e676ba603ff52c666f7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/udp_offload.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.4\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-02-28T20:31:59.928019Z\",\"id\":\"CVE-2021-47036\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.6\",\"versionEndExcluding\":\"5.12.4\",\"matchCriteriaId\":\"2FAD935D-A5F1-4985-B35B-998850A9C49D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/18f25dc399901426dff61e676ba603ff52c666f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/450687386cd16d081b58cd7a342acff370a96078\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/18f25dc399901426dff61e676ba603ff52c666f7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/450687386cd16d081b58cd7a342acff370a96078\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:06:24+00:00",
      "cve": "CVE-2021-47036",
      "id": "CVE-2021-47036",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: udp: skip L4 aggregation for UDP tunnel packets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47036.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:23:46Z",
      "cve": "CVE-2021-47036",
      "id": "CVE-2021-47036",
      "initial_release_date": "2024-03-01T04:07:52Z",
      "product_status:known_not_affected": "292",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47036",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47036.json",
      "version": "17"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/450687386cd16d081b58cd7a342acff370a96078\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/18f25dc399901426dff61e676ba603ff52c666f7\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.049Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47036\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-28T20:31:59.928019Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:13.820Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"udp: skip L4 aggregation for UDP tunnel packets\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The bug is in udp_gro_receive()/udp4_gro_receive on the NAPI GRO receive path for inbound UDP packets, so a remote peer triggers it by sending UDP/VXLAN/Geneve traffic to a host with UDP tunnels; no local syscall is required.\\nAC:L - With rx-gro-list or rx-udp-gro-forwarding enabled (the vulnerable configuration assumed for Base scoring), an attacker can reliably force incorrect L4/fraglist aggregation by sending packets that share the outer UDP flow while differing in inner tunnel headers; no race or uncontrolled memory layout is required.\\nPR:N - Packet processing occurs in the kernel networking stack before any application authentication; sending UDP packets to the tunnel port needs no account or capability on the target.\\nUI:N - Exploitation is fully driven by attacker-sent packets against an already-configured UDP tunnel endpoint; no victim user action is required.\\nS:U - Impact stays within the host kernel network stack and tunnel datapath under the same OS security authority; this is not a VM/IOMMU/sandbox escape.\\nC:H - Incorrect outer-UDP aggregation ignores VXLAN/Geneve identifiers and can merge packets from different tunnel namespaces into one GSO unit, enabling cross-tenant/cross-VNI exposure of encapsulated payloads in multi-tenant overlay deployments.\\nI:H - The fix documents inner protocol corruption: different VXLAN IDs are aggregated, inner headers are ignored, and tunnel/TCP streams are rewritten into incorrect GSO packets, which is attacker-influenced corruption of network data integrity.\\nA:H - Mis-aggregation holds and corrupts tunnel traffic (including TCP-over-VXLAN delayed until GRO flush) and can produce malformed GSO/fraglist skbs on the tunnel receive path, denying overlay service and aligning with the related GRO-into-tunnel crash class.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9fd1ff5d2ac7181844735806b0a703c942365291\", \"lessThan\": \"450687386cd16d081b58cd7a342acff370a96078\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9fd1ff5d2ac7181844735806b0a703c942365291\", \"lessThan\": \"18f25dc399901426dff61e676ba603ff52c666f7\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv4/udp_offload.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.12.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv4/udp_offload.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/450687386cd16d081b58cd7a342acff370a96078\"}, {\"url\": \"https://git.kernel.org/stable/c/18f25dc399901426dff61e676ba603ff52c666f7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nudp: skip L4 aggregation for UDP tunnel packets\\n\\nIf NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there\\nare UDP tunnels available in the system, udp_gro_receive() could end-up\\ndoing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at\\nthe outer UDP tunnel level for packets effectively carrying and UDP\\ntunnel header.\\n\\nThat could cause inner protocol corruption. If e.g. the relevant\\npackets carry a vxlan header, different vxlan ids will be ignored/\\naggregated to the same GSO packet. Inner headers will be ignored, too,\\nso that e.g. TCP over vxlan push packets will be held in the GRO\\nengine till the next flush, etc.\\n\\nJust skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the\\ncurrent packet could land in a UDP tunnel, and let udp_gro_receive()\\ndo GRO via udp_sk(sk)-\u003egro_receive.\\n\\nThe check implemented in this patch is broader than what is strictly\\nneeded, as the existing UDP tunnel could be e.g. configured on top of\\na different device: we could end-up skipping GRO at-all for some packets.\\n\\nAnyhow, that is a very thin corner case and covering it will add quite\\na bit of complexity.\\n\\nv1 -\u003e v2:\\n - hopefully clarify the commit message\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.4\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"5.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:45:39.890Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47036\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:45:39.890Z\", \"dateReserved\": \"2024-02-27T18:42:55.965Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-28T08:13:44.034Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.