CVE-2021-47099 (GCVE-0-2021-47099)

Vulnerability from cvelistv5 – Published: 2024-03-04 18:10 – Updated: 2026-08-05 08:45
VLAI
Title
veth: ensure skb entering GRO are not cloned.
Summary
In the Linux kernel, the following vulnerability has been resolved: veth: ensure skb entering GRO are not cloned. After commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP"), if GRO is enabled on a veth device and TSO is disabled on the peer device, TCP skbs will go through the NAPI callback. If there is no XDP program attached, the veth code does not perform any share check, and shared/cloned skbs could enter the GRO engine. Ignat reported a BUG triggered later-on due to the above condition: [ 53.970529][ C1] kernel BUG at net/core/skbuff.c:3574! [ 53.981755][ C1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 53.982634][ C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc5+ #25 [ 53.982634][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 [ 53.982634][ C1] RIP: 0010:skb_shift+0x13ef/0x23b0 [ 53.982634][ C1] Code: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f 85 74 f5 ff ff <0f> 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89 f7 4c 89 8c [ 53.982634][ C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246 [ 53.982634][ C1] RAX: 0000000000000000 RBX: ffff8881180b4c80 RCX: 0000000000000000 [ 53.982634][ C1] RDX: 0000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2 [ 53.982634][ C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0 [ 53.982634][ C1] R10: ffffed1022999e5c R11: 0000000000000002 R12: 0000000000000590 [ 53.982634][ C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0 [ 53.982634][ C1] FS: 0000000000000000(0000) GS:ffff888235880000(0000) knlGS:0000000000000000 [ 53.982634][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.982634][ C1] CR2: 00007ff5f9b86680 CR3: 0000000108ce8004 CR4: 0000000000170ee0 [ 53.982634][ C1] Call Trace: [ 53.982634][ C1] <TASK> [ 53.982634][ C1] tcp_sacktag_walk+0xaba/0x18e0 [ 53.982634][ C1] tcp_sacktag_write_queue+0xe7b/0x3460 [ 53.982634][ C1] tcp_ack+0x2666/0x54b0 [ 53.982634][ C1] tcp_rcv_established+0x4d9/0x20f0 [ 53.982634][ C1] tcp_v4_do_rcv+0x551/0x810 [ 53.982634][ C1] tcp_v4_rcv+0x22ed/0x2ed0 [ 53.982634][ C1] ip_protocol_deliver_rcu+0x96/0xaf0 [ 53.982634][ C1] ip_local_deliver_finish+0x1e0/0x2f0 [ 53.982634][ C1] ip_sublist_rcv_finish+0x211/0x440 [ 53.982634][ C1] ip_list_rcv_finish.constprop.0+0x424/0x660 [ 53.982634][ C1] ip_list_rcv+0x2c8/0x410 [ 53.982634][ C1] __netif_receive_skb_list_core+0x65c/0x910 [ 53.982634][ C1] netif_receive_skb_list_internal+0x5f9/0xcb0 [ 53.982634][ C1] napi_complete_done+0x188/0x6e0 [ 53.982634][ C1] gro_cell_poll+0x10c/0x1d0 [ 53.982634][ C1] __napi_poll+0xa1/0x530 [ 53.982634][ C1] net_rx_action+0x567/0x1270 [ 53.982634][ C1] __do_softirq+0x28a/0x9ba [ 53.982634][ C1] run_ksoftirqd+0x32/0x60 [ 53.982634][ C1] smpboot_thread_fn+0x559/0x8c0 [ 53.982634][ C1] kthread+0x3b9/0x490 [ 53.982634][ C1] ret_from_fork+0x22/0x30 [ 53.982634][ C1] </TASK> Address the issue by skipping the GRO stage for shared or cloned skbs. To reduce the chance of OoO, try to unclone the skbs before giving up. v1 -> v2: - use avoid skb_copy and fallback to netif_receive_skb - Eric
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c , < d2269ae48598e05b59ec9ea9e6e44fd33941130d (git)
Affected: d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c , < 9695b7de5b4760ed22132aca919570c0190cb0ce (git)
Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.12 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47099",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-12T14:24:44.909749Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-31T14:56:58.471Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.924Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d2269ae48598e05b59ec9ea9e6e44fd33941130d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9695b7de5b4760ed22132aca919570c0190cb0ce"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/veth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d2269ae48598e05b59ec9ea9e6e44fd33941130d",
              "status": "affected",
              "version": "d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c",
              "versionType": "git"
            },
            {
              "lessThan": "9695b7de5b4760ed22132aca919570c0190cb0ce",
              "status": "affected",
              "version": "d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/veth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.12",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: ensure skb entering GRO are not cloned.\n\nAfter commit d3256efd8e8b (\"veth: allow enabling NAPI even without XDP\"),\nif GRO is enabled on a veth device and TSO is disabled on the peer\ndevice, TCP skbs will go through the NAPI callback. If there is no XDP\nprogram attached, the veth code does not perform any share check, and\nshared/cloned skbs could enter the GRO engine.\n\nIgnat reported a BUG triggered later-on due to the above condition:\n\n[   53.970529][    C1] kernel BUG at net/core/skbuff.c:3574!\n[   53.981755][    C1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\n[   53.982634][    C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc5+ #25\n[   53.982634][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n[   53.982634][    C1] RIP: 0010:skb_shift+0x13ef/0x23b0\n[   53.982634][    C1] Code: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0\n7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f\n85 74 f5 ff ff \u003c0f\u003e 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89\nf7 4c 89 8c\n[   53.982634][    C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246\n[   53.982634][    C1] RAX: 0000000000000000 RBX: ffff8881180b4c80 RCX: 0000000000000000\n[   53.982634][    C1] RDX: 0000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2\n[   53.982634][    C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0\n[   53.982634][    C1] R10: ffffed1022999e5c R11: 0000000000000002 R12: 0000000000000590\n[   53.982634][    C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0\n[   53.982634][    C1] FS:  0000000000000000(0000) GS:ffff888235880000(0000) knlGS:0000000000000000\n[   53.982634][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   53.982634][    C1] CR2: 00007ff5f9b86680 CR3: 0000000108ce8004 CR4: 0000000000170ee0\n[   53.982634][    C1] Call Trace:\n[   53.982634][    C1]  \u003cTASK\u003e\n[   53.982634][    C1]  tcp_sacktag_walk+0xaba/0x18e0\n[   53.982634][    C1]  tcp_sacktag_write_queue+0xe7b/0x3460\n[   53.982634][    C1]  tcp_ack+0x2666/0x54b0\n[   53.982634][    C1]  tcp_rcv_established+0x4d9/0x20f0\n[   53.982634][    C1]  tcp_v4_do_rcv+0x551/0x810\n[   53.982634][    C1]  tcp_v4_rcv+0x22ed/0x2ed0\n[   53.982634][    C1]  ip_protocol_deliver_rcu+0x96/0xaf0\n[   53.982634][    C1]  ip_local_deliver_finish+0x1e0/0x2f0\n[   53.982634][    C1]  ip_sublist_rcv_finish+0x211/0x440\n[   53.982634][    C1]  ip_list_rcv_finish.constprop.0+0x424/0x660\n[   53.982634][    C1]  ip_list_rcv+0x2c8/0x410\n[   53.982634][    C1]  __netif_receive_skb_list_core+0x65c/0x910\n[   53.982634][    C1]  netif_receive_skb_list_internal+0x5f9/0xcb0\n[   53.982634][    C1]  napi_complete_done+0x188/0x6e0\n[   53.982634][    C1]  gro_cell_poll+0x10c/0x1d0\n[   53.982634][    C1]  __napi_poll+0xa1/0x530\n[   53.982634][    C1]  net_rx_action+0x567/0x1270\n[   53.982634][    C1]  __do_softirq+0x28a/0x9ba\n[   53.982634][    C1]  run_ksoftirqd+0x32/0x60\n[   53.982634][    C1]  smpboot_thread_fn+0x559/0x8c0\n[   53.982634][    C1]  kthread+0x3b9/0x490\n[   53.982634][    C1]  ret_from_fork+0x22/0x30\n[   53.982634][    C1]  \u003c/TASK\u003e\n\nAddress the issue by skipping the GRO stage for shared or cloned skbs.\nTo reduce the chance of OoO, try to unclone the skbs before giving up.\n\nv1 -\u003e v2:\n - use avoid skb_copy and fallback to netif_receive_skb  - Eric"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the veth virtual-device TX/RX path and is triggered by locally originated TCP skbs crossing a veth pair (typically clones from tcp_transmit_skb), not by unauthenticated remote packets on a network-facing protocol.\nAC:L - An attacker who can create/configure a veth pair fully controls GRO-on/TSO-off and both ends of the TCP connection, so cloned skbs reliably enter GRO and the failure can be provoked without relying on external timing or layout.\nPR:L - Creating veth devices and toggling GRO/TSO requires only CAP_NET_ADMIN in the owning user_ns, which an unprivileged process obtains via user namespaces (unshare -Urn), so privileges are Low rather than real host root.\nUI:N - No victim action is required; the attacker configures the interfaces and generates the TCP traffic that hits the vulnerable path.\nS:U - Impact stays within the host kernel\u2019s authority (crash/memory corruption of sk_buff state); this is not a VM, IOMMU, or other cross-boundary escape.\nC:H - GRO coalescing mutates shared skb_shinfo/frags of cloned skbs, corrupting the peer clone still on the TCP retransmit queue and enabling use-after-free or disclosure of page-backed packet data.\nI:H - The same shared-frag corruption can break page ownership (stolen/zeroed nr_frags, merge-path frag edits), yielding double-free or attacker-influenced writes consistent with heap memory-corruption primitives.\nA:H - The reported outcome is an unconditional kernel BUG_ON in skb_shift during TCP SACK processing, which oopses/panics the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:58.170Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d2269ae48598e05b59ec9ea9e6e44fd33941130d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9695b7de5b4760ed22132aca919570c0190cb0ce"
        }
      ],
      "title": "veth: ensure skb entering GRO are not cloned.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47099",
    "datePublished": "2024-03-04T18:10:51.200Z",
    "dateReserved": "2024-02-29T22:33:44.301Z",
    "dateUpdated": "2026-08-05T08:45:58.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47099",
      "date": "2026-08-05",
      "epss": "0.0021",
      "percentile": "0.11324"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nveth: ensure skb entering GRO are not cloned.\\n\\nAfter commit d3256efd8e8b (\\\"veth: allow enabling NAPI even without XDP\\\"),\\nif GRO is enabled on a veth device and TSO is disabled on the peer\\ndevice, TCP skbs will go through the NAPI callback. If there is no XDP\\nprogram attached, the veth code does not perform any share check, and\\nshared/cloned skbs could enter the GRO engine.\\n\\nIgnat reported a BUG triggered later-on due to the above condition:\\n\\n[   53.970529][    C1] kernel BUG at net/core/skbuff.c:3574!\\n[   53.981755][    C1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\\n[   53.982634][    C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc5+ #25\\n[   53.982634][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\\n[   53.982634][    C1] RIP: 0010:skb_shift+0x13ef/0x23b0\\n[   53.982634][    C1] Code: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0\\n7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f\\n85 74 f5 ff ff \u003c0f\u003e 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89\\nf7 4c 89 8c\\n[   53.982634][    C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246\\n[   53.982634][    C1] RAX: 0000000000000000 RBX: ffff8881180b4c80 RCX: 0000000000000000\\n[   53.982634][    C1] RDX: 0000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2\\n[   53.982634][    C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0\\n[   53.982634][    C1] R10: ffffed1022999e5c R11: 0000000000000002 R12: 0000000000000590\\n[   53.982634][    C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0\\n[   53.982634][    C1] FS:  0000000000000000(0000) GS:ffff888235880000(0000) knlGS:0000000000000000\\n[   53.982634][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[   53.982634][    C1] CR2: 00007ff5f9b86680 CR3: 0000000108ce8004 CR4: 0000000000170ee0\\n[   53.982634][    C1] Call Trace:\\n[   53.982634][    C1]  \u003cTASK\u003e\\n[   53.982634][    C1]  tcp_sacktag_walk+0xaba/0x18e0\\n[   53.982634][    C1]  tcp_sacktag_write_queue+0xe7b/0x3460\\n[   53.982634][    C1]  tcp_ack+0x2666/0x54b0\\n[   53.982634][    C1]  tcp_rcv_established+0x4d9/0x20f0\\n[   53.982634][    C1]  tcp_v4_do_rcv+0x551/0x810\\n[   53.982634][    C1]  tcp_v4_rcv+0x22ed/0x2ed0\\n[   53.982634][    C1]  ip_protocol_deliver_rcu+0x96/0xaf0\\n[   53.982634][    C1]  ip_local_deliver_finish+0x1e0/0x2f0\\n[   53.982634][    C1]  ip_sublist_rcv_finish+0x211/0x440\\n[   53.982634][    C1]  ip_list_rcv_finish.constprop.0+0x424/0x660\\n[   53.982634][    C1]  ip_list_rcv+0x2c8/0x410\\n[   53.982634][    C1]  __netif_receive_skb_list_core+0x65c/0x910\\n[   53.982634][    C1]  netif_receive_skb_list_internal+0x5f9/0xcb0\\n[   53.982634][    C1]  napi_complete_done+0x188/0x6e0\\n[   53.982634][    C1]  gro_cell_poll+0x10c/0x1d0\\n[   53.982634][    C1]  __napi_poll+0xa1/0x530\\n[   53.982634][    C1]  net_rx_action+0x567/0x1270\\n[   53.982634][    C1]  __do_softirq+0x28a/0x9ba\\n[   53.982634][    C1]  run_ksoftirqd+0x32/0x60\\n[   53.982634][    C1]  smpboot_thread_fn+0x559/0x8c0\\n[   53.982634][    C1]  kthread+0x3b9/0x490\\n[   53.982634][    C1]  ret_from_fork+0x22/0x30\\n[   53.982634][    C1]  \u003c/TASK\u003e\\n\\nAddress the issue by skipping the GRO stage for shared or cloned skbs.\\nTo reduce the chance of OoO, try to unclone the skbs before giving up.\\n\\nv1 -\u003e v2:\\n - use avoid skb_copy and fallback to netif_receive_skb  - Eric\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: veth: aseg\\u00farese de que los skb que ingresan a GRO no est\\u00e9n clonados. Despu\\u00e9s de confirmar d3256efd8e8b (\\\"veth: permitir habilitar NAPI incluso sin XDP\\\"), si GRO est\\u00e1 habilitado en un dispositivo veth y TSO est\\u00e1 deshabilitado en el dispositivo par, los skbs TCP pasar\\u00e1n por la devoluci\\u00f3n de llamada de NAPI. Si no hay ning\\u00fan programa XDP adjunto, el c\\u00f3digo veth no realiza ninguna verificaci\\u00f3n compartida y los skbs compartidos/clonados podr\\u00edan ingresar al motor GRO. Ignat inform\\u00f3 de un ERROR que se activ\\u00f3 m\\u00e1s tarde debido a la condici\\u00f3n anterior: [53.970529][C1] ERROR del kernel en net/core/skbuff.c:3574. [ 53.981755][ C1] c\\u00f3digo de operaci\\u00f3n no v\\u00e1lido: 0000 [#1] PREEMPT SMP KASAN PTI [ 53.982634][ C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 No contaminado 5.16.0-rc5+ #25 [ 53.982634][ C1] Nombre del hardware: PC est\\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS 0.0.0 06/02/2015 [ 53.982634][ C1] RIP: 0010:skb_shift+0x13ef/0x23b0 [ 53.982634][ C1] C\\u00f3digo: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f 85 74 f5 ff ff \u0026lt;0f\u0026gt; 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89 f7 4c 89 8c [ 53.982634][ C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246 [ 53.982634][ C1] RAX: 0000000000000000000000 RB X: ffff8881180b4c80 RCX: 0000000000000000 [ 53.982634][ C1] RDX: 00000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2 [ 53.982634][ C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0 [ 53.982634][ C1] R10: ff ffed1022999e5c R11: 0000000000000002 R12: 0000000000000590 [ 53.982634][ C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0 [ 53.982634][ C1] FS: 00000000000000000(0000) GS:ffff888235880000(0000) knlGS:00000000000000000 [ 53.982634][ C1] CS: 0010 DS: 00 00 ES: 0000 CR0: 0000000080050033 [ 53.982634][ C1] CR2: 00007ff5f9b86680 CR3 : 0000000108ce8004 CR4: 0000000000170ee0 [ 53.982634][ C1] Seguimiento de llamadas: [ 53.982634][ C1]  [ 53.982634][ C1] tcp_sacktag_walk+0xaba/0x18e0 [ 53.982634][ C1] t cp_sacktag_write_queue+0xe7b/0x3460 [ 53.982634][ C1 ] tcp_ack+0x2666/0x54b0 [ 53.982634][ C1] tcp_rcv_establecido+0x4d9/0x20f0 [ 53.982634][ C1] tcp_v4_do_rcv+0x551/0x810 [ 53.982634][ C1] tcp_v4_rcv+0x 22ed/0x2ed0 [ 53.982634][ C1] ip_protocol_deliver_rcu+0x96/0xaf0 [ 53.982634][ C1] ip_local_deliver_finish+0x1e0/0x2f0 [ 53.982634][ C1] ip_sublist_rcv_finish+0x211/0x440 [ 53.982634][ C1] ip_list_rcv_finish.constprop.0+0x424/0x660 [ 53.9 82634][C1] ip_list_rcv+0x2c8/0x410 [ 53.982634 ][ C1] __netif_receive_skb_list_core+0x65c/0x910 [ 53.982634][ C1] netif_receive_skb_list_internal+0x5f9/0xcb0 [ 53.982634][ C1] napi_complete_done+0x188/0x6e0 [ 53.982634][ C1] gro_cell_ encuesta+0x10c/0x1d0 [ 53.982634][ C1] __napi_poll+ 0xa1/0x530 [ 53.982634][ C1] net_rx_action+0x567/0x1270 [ 53.982634][ C1] __do_softirq+0x28a/0x9ba [ 53.982634][ C1] run_ksoftirqd+0x32/0x60 [ 53.982634][ C1] smpboot_thread_fn+0x559/0x8c0 [53.982634] [ C1] kthread+0x3b9/0x490 [ 53.982634][ C1] ret_from_fork+0x22/0x30 [ 53.982634][ C1]  Solucione el problema omitiendo la etapa GRO para skbs compartidos o clonados. Para reducir la posibilidad de OoO, intente desbloquear los skbs antes de darse por vencido. v1 -\u0026gt; v2: - use evitar skb_copy y recurra a netif_receive_skb - Eric\"}]",
      "id": "CVE-2021-47099",
      "lastModified": "2024-11-21T06:35:23.757",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H\", \"baseScore\": 6.0, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 0.8, \"impactScore\": 5.2}]}",
      "published": "2024-03-04T18:15:08.153",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/9695b7de5b4760ed22132aca919570c0190cb0ce\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d2269ae48598e05b59ec9ea9e6e44fd33941130d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9695b7de5b4760ed22132aca919570c0190cb0ce\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d2269ae48598e05b59ec9ea9e6e44fd33941130d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47099\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-04T18:15:08.153\",\"lastModified\":\"2026-08-04T10:16:45.360\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nveth: ensure skb entering GRO are not cloned.\\n\\nAfter commit d3256efd8e8b (\\\"veth: allow enabling NAPI even without XDP\\\"),\\nif GRO is enabled on a veth device and TSO is disabled on the peer\\ndevice, TCP skbs will go through the NAPI callback. If there is no XDP\\nprogram attached, the veth code does not perform any share check, and\\nshared/cloned skbs could enter the GRO engine.\\n\\nIgnat reported a BUG triggered later-on due to the above condition:\\n\\n[   53.970529][    C1] kernel BUG at net/core/skbuff.c:3574!\\n[   53.981755][    C1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\\n[   53.982634][    C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc5+ #25\\n[   53.982634][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\\n[   53.982634][    C1] RIP: 0010:skb_shift+0x13ef/0x23b0\\n[   53.982634][    C1] Code: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0\\n7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f\\n85 74 f5 ff ff \u003c0f\u003e 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89\\nf7 4c 89 8c\\n[   53.982634][    C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246\\n[   53.982634][    C1] RAX: 0000000000000000 RBX: ffff8881180b4c80 RCX: 0000000000000000\\n[   53.982634][    C1] RDX: 0000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2\\n[   53.982634][    C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0\\n[   53.982634][    C1] R10: ffffed1022999e5c R11: 0000000000000002 R12: 0000000000000590\\n[   53.982634][    C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0\\n[   53.982634][    C1] FS:  0000000000000000(0000) GS:ffff888235880000(0000) knlGS:0000000000000000\\n[   53.982634][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[   53.982634][    C1] CR2: 00007ff5f9b86680 CR3: 0000000108ce8004 CR4: 0000000000170ee0\\n[   53.982634][    C1] Call Trace:\\n[   53.982634][    C1]  \u003cTASK\u003e\\n[   53.982634][    C1]  tcp_sacktag_walk+0xaba/0x18e0\\n[   53.982634][    C1]  tcp_sacktag_write_queue+0xe7b/0x3460\\n[   53.982634][    C1]  tcp_ack+0x2666/0x54b0\\n[   53.982634][    C1]  tcp_rcv_established+0x4d9/0x20f0\\n[   53.982634][    C1]  tcp_v4_do_rcv+0x551/0x810\\n[   53.982634][    C1]  tcp_v4_rcv+0x22ed/0x2ed0\\n[   53.982634][    C1]  ip_protocol_deliver_rcu+0x96/0xaf0\\n[   53.982634][    C1]  ip_local_deliver_finish+0x1e0/0x2f0\\n[   53.982634][    C1]  ip_sublist_rcv_finish+0x211/0x440\\n[   53.982634][    C1]  ip_list_rcv_finish.constprop.0+0x424/0x660\\n[   53.982634][    C1]  ip_list_rcv+0x2c8/0x410\\n[   53.982634][    C1]  __netif_receive_skb_list_core+0x65c/0x910\\n[   53.982634][    C1]  netif_receive_skb_list_internal+0x5f9/0xcb0\\n[   53.982634][    C1]  napi_complete_done+0x188/0x6e0\\n[   53.982634][    C1]  gro_cell_poll+0x10c/0x1d0\\n[   53.982634][    C1]  __napi_poll+0xa1/0x530\\n[   53.982634][    C1]  net_rx_action+0x567/0x1270\\n[   53.982634][    C1]  __do_softirq+0x28a/0x9ba\\n[   53.982634][    C1]  run_ksoftirqd+0x32/0x60\\n[   53.982634][    C1]  smpboot_thread_fn+0x559/0x8c0\\n[   53.982634][    C1]  kthread+0x3b9/0x490\\n[   53.982634][    C1]  ret_from_fork+0x22/0x30\\n[   53.982634][    C1]  \u003c/TASK\u003e\\n\\nAddress the issue by skipping the GRO stage for shared or cloned skbs.\\nTo reduce the chance of OoO, try to unclone the skbs before giving up.\\n\\nv1 -\u003e v2:\\n - use avoid skb_copy and fallback to netif_receive_skb  - Eric\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: veth: aseg\u00farese de que los skb que ingresan a GRO no est\u00e9n clonados. Despu\u00e9s de confirmar d3256efd8e8b (\\\"veth: permitir habilitar NAPI incluso sin XDP\\\"), si GRO est\u00e1 habilitado en un dispositivo veth y TSO est\u00e1 deshabilitado en el dispositivo par, los skbs TCP pasar\u00e1n por la devoluci\u00f3n de llamada de NAPI. Si no hay ning\u00fan programa XDP adjunto, el c\u00f3digo veth no realiza ninguna verificaci\u00f3n compartida y los skbs compartidos/clonados podr\u00edan ingresar al motor GRO. Ignat inform\u00f3 de un ERROR que se activ\u00f3 m\u00e1s tarde debido a la condici\u00f3n anterior: [53.970529][C1] ERROR del kernel en net/core/skbuff.c:3574. [ 53.981755][ C1] c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] PREEMPT SMP KASAN PTI [ 53.982634][ C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 No contaminado 5.16.0-rc5+ #25 [ 53.982634][ C1] Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS 0.0.0 06/02/2015 [ 53.982634][ C1] RIP: 0010:skb_shift+0x13ef/0x23b0 [ 53.982634][ C1] C\u00f3digo: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f 85 74 f5 ff ff \u0026lt;0f\u0026gt; 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89 f7 4c 89 8c [ 53.982634][ C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246 [ 53.982634][ C1] RAX: 0000000000000000000000 RB X: ffff8881180b4c80 RCX: 0000000000000000 [ 53.982634][ C1] RDX: 00000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2 [ 53.982634][ C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0 [ 53.982634][ C1] R10: ff ffed1022999e5c R11: 0000000000000002 R12: 0000000000000590 [ 53.982634][ C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0 [ 53.982634][ C1] FS: 00000000000000000(0000) GS:ffff888235880000(0000) knlGS:00000000000000000 [ 53.982634][ C1] CS: 0010 DS: 00 00 ES: 0000 CR0: 0000000080050033 [ 53.982634][ C1] CR2: 00007ff5f9b86680 CR3 : 0000000108ce8004 CR4: 0000000000170ee0 [ 53.982634][ C1] Seguimiento de llamadas: [ 53.982634][ C1]  [ 53.982634][ C1] tcp_sacktag_walk+0xaba/0x18e0 [ 53.982634][ C1] t cp_sacktag_write_queue+0xe7b/0x3460 [ 53.982634][ C1 ] tcp_ack+0x2666/0x54b0 [ 53.982634][ C1] tcp_rcv_establecido+0x4d9/0x20f0 [ 53.982634][ C1] tcp_v4_do_rcv+0x551/0x810 [ 53.982634][ C1] tcp_v4_rcv+0x 22ed/0x2ed0 [ 53.982634][ C1] ip_protocol_deliver_rcu+0x96/0xaf0 [ 53.982634][ C1] ip_local_deliver_finish+0x1e0/0x2f0 [ 53.982634][ C1] ip_sublist_rcv_finish+0x211/0x440 [ 53.982634][ C1] ip_list_rcv_finish.constprop.0+0x424/0x660 [ 53.9 82634][C1] ip_list_rcv+0x2c8/0x410 [ 53.982634 ][ C1] __netif_receive_skb_list_core+0x65c/0x910 [ 53.982634][ C1] netif_receive_skb_list_internal+0x5f9/0xcb0 [ 53.982634][ C1] napi_complete_done+0x188/0x6e0 [ 53.982634][ C1] gro_cell_ encuesta+0x10c/0x1d0 [ 53.982634][ C1] __napi_poll+ 0xa1/0x530 [ 53.982634][ C1] net_rx_action+0x567/0x1270 [ 53.982634][ C1] __do_softirq+0x28a/0x9ba [ 53.982634][ C1] run_ksoftirqd+0x32/0x60 [ 53.982634][ C1] smpboot_thread_fn+0x559/0x8c0 [53.982634] [ C1] kthread+0x3b9/0x490 [ 53.982634][ C1] ret_from_fork+0x22/0x30 [ 53.982634][ C1]  Solucione el problema omitiendo la etapa GRO para skbs compartidos o clonados. Para reducir la posibilidad de OoO, intente desbloquear los skbs antes de darse por vencido. v1 -\u0026gt; v2: - use evitar skb_copy y recurra a netif_receive_skb - Eric\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/veth.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c\",\"lessThan\":\"d2269ae48598e05b59ec9ea9e6e44fd33941130d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c\",\"lessThan\":\"9695b7de5b4760ed22132aca919570c0190cb0ce\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/veth.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.12\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":6.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-03-12T14:24:44.909749Z\",\"id\":\"CVE-2021-47099\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"5.15.12\",\"matchCriteriaId\":\"164CFFE2-DFF5-4AA3-B0D8-BDA39E712F48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A73429BA-C2D9-4D0C-A75F-06A1CA8B3983\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F621B5E3-E99D-49E7-90B9-EC3B77C95383\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7BFDCAA-1650-49AA-8462-407DD593F94F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6EC9882F-866D-4ACB-8FBC-213D8D8436C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A0915FE-A4AA-4C94-B783-CF29D81E7E54\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9695b7de5b4760ed22132aca919570c0190cb0ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d2269ae48598e05b59ec9ea9e6e44fd33941130d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9695b7de5b4760ed22132aca919570c0190cb0ce\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d2269ae48598e05b59ec9ea9e6e44fd33941130d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:04:42+00:00",
      "cve": "CVE-2021-47099",
      "id": "CVE-2021-47099",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:fixed": "475",
      "product_status:known_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: veth: ensure skb entering GRO are not cloned.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47099.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:23:19Z",
      "cve": "CVE-2021-47099",
      "id": "CVE-2021-47099",
      "initial_release_date": "2024-03-06T04:52:28Z",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "253",
      "product_status:recommended": "513",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47099",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47099.json",
      "version": "52"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d2269ae48598e05b59ec9ea9e6e44fd33941130d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9695b7de5b4760ed22132aca919570c0190cb0ce\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.924Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47099\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-12T14:24:44.909749Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:16.883Z\"}}], \"cna\": {\"title\": \"veth: ensure skb entering GRO are not cloned.\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in the veth virtual-device TX/RX path and is triggered by locally originated TCP skbs crossing a veth pair (typically clones from tcp_transmit_skb), not by unauthenticated remote packets on a network-facing protocol.\\nAC:L - An attacker who can create/configure a veth pair fully controls GRO-on/TSO-off and both ends of the TCP connection, so cloned skbs reliably enter GRO and the failure can be provoked without relying on external timing or layout.\\nPR:L - Creating veth devices and toggling GRO/TSO requires only CAP_NET_ADMIN in the owning user_ns, which an unprivileged process obtains via user namespaces (unshare -Urn), so privileges are Low rather than real host root.\\nUI:N - No victim action is required; the attacker configures the interfaces and generates the TCP traffic that hits the vulnerable path.\\nS:U - Impact stays within the host kernel\\u2019s authority (crash/memory corruption of sk_buff state); this is not a VM, IOMMU, or other cross-boundary escape.\\nC:H - GRO coalescing mutates shared skb_shinfo/frags of cloned skbs, corrupting the peer clone still on the TCP retransmit queue and enabling use-after-free or disclosure of page-backed packet data.\\nI:H - The same shared-frag corruption can break page ownership (stolen/zeroed nr_frags, merge-path frag edits), yielding double-free or attacker-influenced writes consistent with heap memory-corruption primitives.\\nA:H - The reported outcome is an unconditional kernel BUG_ON in skb_shift during TCP SACK processing, which oopses/panics the host.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c\", \"lessThan\": \"d2269ae48598e05b59ec9ea9e6e44fd33941130d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c\", \"lessThan\": \"9695b7de5b4760ed22132aca919570c0190cb0ce\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/veth.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/veth.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d2269ae48598e05b59ec9ea9e6e44fd33941130d\"}, {\"url\": \"https://git.kernel.org/stable/c/9695b7de5b4760ed22132aca919570c0190cb0ce\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nveth: ensure skb entering GRO are not cloned.\\n\\nAfter commit d3256efd8e8b (\\\"veth: allow enabling NAPI even without XDP\\\"),\\nif GRO is enabled on a veth device and TSO is disabled on the peer\\ndevice, TCP skbs will go through the NAPI callback. If there is no XDP\\nprogram attached, the veth code does not perform any share check, and\\nshared/cloned skbs could enter the GRO engine.\\n\\nIgnat reported a BUG triggered later-on due to the above condition:\\n\\n[   53.970529][    C1] kernel BUG at net/core/skbuff.c:3574!\\n[   53.981755][    C1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\\n[   53.982634][    C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc5+ #25\\n[   53.982634][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\\n[   53.982634][    C1] RIP: 0010:skb_shift+0x13ef/0x23b0\\n[   53.982634][    C1] Code: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0\\n7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f\\n85 74 f5 ff ff \u003c0f\u003e 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89\\nf7 4c 89 8c\\n[   53.982634][    C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246\\n[   53.982634][    C1] RAX: 0000000000000000 RBX: ffff8881180b4c80 RCX: 0000000000000000\\n[   53.982634][    C1] RDX: 0000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2\\n[   53.982634][    C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0\\n[   53.982634][    C1] R10: ffffed1022999e5c R11: 0000000000000002 R12: 0000000000000590\\n[   53.982634][    C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0\\n[   53.982634][    C1] FS:  0000000000000000(0000) GS:ffff888235880000(0000) knlGS:0000000000000000\\n[   53.982634][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[   53.982634][    C1] CR2: 00007ff5f9b86680 CR3: 0000000108ce8004 CR4: 0000000000170ee0\\n[   53.982634][    C1] Call Trace:\\n[   53.982634][    C1]  \u003cTASK\u003e\\n[   53.982634][    C1]  tcp_sacktag_walk+0xaba/0x18e0\\n[   53.982634][    C1]  tcp_sacktag_write_queue+0xe7b/0x3460\\n[   53.982634][    C1]  tcp_ack+0x2666/0x54b0\\n[   53.982634][    C1]  tcp_rcv_established+0x4d9/0x20f0\\n[   53.982634][    C1]  tcp_v4_do_rcv+0x551/0x810\\n[   53.982634][    C1]  tcp_v4_rcv+0x22ed/0x2ed0\\n[   53.982634][    C1]  ip_protocol_deliver_rcu+0x96/0xaf0\\n[   53.982634][    C1]  ip_local_deliver_finish+0x1e0/0x2f0\\n[   53.982634][    C1]  ip_sublist_rcv_finish+0x211/0x440\\n[   53.982634][    C1]  ip_list_rcv_finish.constprop.0+0x424/0x660\\n[   53.982634][    C1]  ip_list_rcv+0x2c8/0x410\\n[   53.982634][    C1]  __netif_receive_skb_list_core+0x65c/0x910\\n[   53.982634][    C1]  netif_receive_skb_list_internal+0x5f9/0xcb0\\n[   53.982634][    C1]  napi_complete_done+0x188/0x6e0\\n[   53.982634][    C1]  gro_cell_poll+0x10c/0x1d0\\n[   53.982634][    C1]  __napi_poll+0xa1/0x530\\n[   53.982634][    C1]  net_rx_action+0x567/0x1270\\n[   53.982634][    C1]  __do_softirq+0x28a/0x9ba\\n[   53.982634][    C1]  run_ksoftirqd+0x32/0x60\\n[   53.982634][    C1]  smpboot_thread_fn+0x559/0x8c0\\n[   53.982634][    C1]  kthread+0x3b9/0x490\\n[   53.982634][    C1]  ret_from_fork+0x22/0x30\\n[   53.982634][    C1]  \u003c/TASK\u003e\\n\\nAddress the issue by skipping the GRO stage for shared or cloned skbs.\\nTo reduce the chance of OoO, try to unclone the skbs before giving up.\\n\\nv1 -\u003e v2:\\n - use avoid skb_copy and fallback to netif_receive_skb  - Eric\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.12\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:45:58.170Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47099\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:45:58.170Z\", \"dateReserved\": \"2024-02-29T22:33:44.301Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-04T18:10:51.200Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.