GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47152 (GCVE-0-2021-47152)

Vulnerability from cvelistv5 – Published: 2024-03-25 09:07 – Updated: 2026-08-05 08:46
VLAI
Title
mptcp: fix data stream corruption
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data stream corruption Maxim reported several issues when forcing a TCP transparent proxy to use the MPTCP protocol for the inbound connections. He also provided a clean reproducer. The problem boils down to 'mptcp_frag_can_collapse_to()' assuming that only MPTCP will use the given page_frag. If others - e.g. the plain TCP protocol - allocate page fragments, we can end-up re-using already allocated memory for mptcp_data_frag. Fix the issue ensuring that the to-be-expanded data fragment is located at the current page frag end. v1 -> v2: - added missing fixes tag (Mat)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:54 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 18b683bff89d46ace55f12d00c0440d44d6160c4 , < 3267a061096efc91eda52c2a0c61ba76e46e4b34 (git)
Affected: 18b683bff89d46ace55f12d00c0440d44d6160c4 , < 18e7f0580da15cac1e79d73683ada5a9e70980f8 (git)
Affected: 18b683bff89d46ace55f12d00c0440d44d6160c4 , < 29249eac5225429b898f278230a6ca2baa1ae154 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.42 , ≤ 5.10.* (semver)
Unaffected: 5.12.9 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.850Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47152",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:54:51.146188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:55.837Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3267a061096efc91eda52c2a0c61ba76e46e4b34",
              "status": "affected",
              "version": "18b683bff89d46ace55f12d00c0440d44d6160c4",
              "versionType": "git"
            },
            {
              "lessThan": "18e7f0580da15cac1e79d73683ada5a9e70980f8",
              "status": "affected",
              "version": "18b683bff89d46ace55f12d00c0440d44d6160c4",
              "versionType": "git"
            },
            {
              "lessThan": "29249eac5225429b898f278230a6ca2baa1ae154",
              "status": "affected",
              "version": "18b683bff89d46ace55f12d00c0440d44d6160c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.42",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.9",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix data stream corruption\n\nMaxim reported several issues when forcing a TCP transparent proxy\nto use the MPTCP protocol for the inbound connections. He also\nprovided a clean reproducer.\n\nThe problem boils down to \u0027mptcp_frag_can_collapse_to()\u0027 assuming\nthat only MPTCP will use the given page_frag.\n\nIf others - e.g. the plain TCP protocol - allocate page fragments,\nwe can end-up re-using already allocated memory for mptcp_data_frag.\n\nFix the issue ensuring that the to-be-expanded data fragment is\nlocated at the current page frag end.\n\nv1 -\u003e v2:\n - added missing fixes tag (Mat)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in mptcp_sendmsg\u2019s page_frag collapse/carve logic, reached via local sendmsg/sendto on an MPTCP socket (syscall path), not by parsing unsolicited received packets.\nAC:L - An unprivileged attacker who opens MPTCP (and/or TCP) sockets in one process fully controls shared current-\u003etask_frag interleaving and can reliably force the false collapse and overlapping reuse; no victim-only timing or layout is required.\nPR:L - Creating IPPROTO_MPTCP sockets needs only net.mptcp.enabled (default on when CONFIG_MPTCP is built); no CAP_NET_ADMIN or init-namespace root is required along the send path.\nUI:N - The attacker triggers the vulnerable sendmsg path themselves on their own sockets; no separate victim action is required.\nS:U - Impact is kernel memory/list corruption and DoS within the same host OS authority\u2014standard local kernel compromise, not a VM/IOMMU/sandbox boundary cross.\nC:H - False collapse lets attacker-controlled send data overwrite in-page mptcp_data_frag fields (page/offset/list); corrupted frags can then be transmitted via tcp_build_frag, and the heap/list corruption is further leverageable for disclosure.\nI:H - Overlapping writes corrupt adjacent mptcp_data_frag list_head and related state (CWE-787), enabling list_add/list_del corruption and arbitrary-write primitives as seen in the reported list_add BUG paths.\nA:H - The same corruption produced kernel BUG_ON list_add/list_del failures, soft lockups at 100% CPU, and host hangs/panics in the documented reproducer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:20.724Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34"
        },
        {
          "url": "https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154"
        }
      ],
      "title": "mptcp: fix data stream corruption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47152",
    "datePublished": "2024-03-25T09:07:47.235Z",
    "dateReserved": "2024-03-04T18:12:48.846Z",
    "dateUpdated": "2026-08-05T08:46:20.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47152",
      "date": "2026-09-20",
      "epss": "0.00241",
      "percentile": "0.15615"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix data stream corruption\n\nMaxim reported several issues when forcing a TCP transparent proxy\nto use the MPTCP protocol for the inbound connections. He also\nprovided a clean reproducer.\n\nThe problem boils down to \u0027mptcp_frag_can_collapse_to()\u0027 assuming\nthat only MPTCP will use the given page_frag.\n\nIf others - e.g. the plain TCP protocol - allocate page fragments,\nwe can end-up re-using already allocated memory for mptcp_data_frag.\n\nFix the issue ensuring that the to-be-expanded data fragment is\nlocated at the current page frag end.\n\nv1 -\u003e v2:\n - added missing fixes tag (Mat)"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: mptcp: corrige la corrupci\u00f3n del flujo de datos Maxim inform\u00f3 varios problemas al forzar a un proxy transparente TCP a utilizar el protocolo MPTCP para las conexiones entrantes. Tambi\u00e9n proporcion\u00f3 un reproductor limpio. El problema se reduce a \u0027mptcp_frag_can_collapse_to()\u0027 suponiendo que s\u00f3lo MPTCP utilizar\u00e1 el page_frag dado. Si otros (por ejemplo, el protocolo TCP simple) asignan fragmentos de p\u00e1gina, podemos terminar reutilizando la memoria ya asignada para mptcp_data_frag. Solucione el problema asegur\u00e1ndose de que el fragmento de datos que se va a expandir est\u00e9 ubicado al final del fragmento de la p\u00e1gina actual. v1 -\u0026gt; v2: - se agreg\u00f3 la etiqueta de correcciones faltantes (Mat)"
        }
      ],
      "id": "CVE-2021-47152",
      "lastModified": "2024-11-21T06:35:30.157",
      "published": "2024-03-25T09:15:09.357",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/protocol.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3267a061096efc91eda52c2a0c61ba76e46e4b34",
                    "status": "affected",
                    "version": "18b683bff89d46ace55f12d00c0440d44d6160c4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "18e7f0580da15cac1e79d73683ada5a9e70980f8",
                    "status": "affected",
                    "version": "18b683bff89d46ace55f12d00c0440d44d6160c4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "29249eac5225429b898f278230a6ca2baa1ae154",
                    "status": "affected",
                    "version": "18b683bff89d46ace55f12d00c0440d44d6160c4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/protocol.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.7"
                  },
                  {
                    "lessThan": "5.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.12.*",
                    "status": "unaffected",
                    "version": "5.12.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "80071323-2D44-440B-A37F-B00E96F0C8C1",
                    "versionEndExcluding": "5.10.42",
                    "versionStartIncluding": "5.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2C8A1D02-81A7-44E5-ACFD-CC6A6694F930",
                    "versionEndExcluding": "5.12.9",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix data stream corruption\n\nMaxim reported several issues when forcing a TCP transparent proxy\nto use the MPTCP protocol for the inbound connections. He also\nprovided a clean reproducer.\n\nThe problem boils down to \u0027mptcp_frag_can_collapse_to()\u0027 assuming\nthat only MPTCP will use the given page_frag.\n\nIf others - e.g. the plain TCP protocol - allocate page fragments,\nwe can end-up re-using already allocated memory for mptcp_data_frag.\n\nFix the issue ensuring that the to-be-expanded data fragment is\nlocated at the current page frag end.\n\nv1 -\u003e v2:\n - added missing fixes tag (Mat)"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: mptcp: corrige la corrupci\u00f3n del flujo de datos Maxim inform\u00f3 varios problemas al forzar a un proxy transparente TCP a utilizar el protocolo MPTCP para las conexiones entrantes. Tambi\u00e9n proporcion\u00f3 un reproductor limpio. El problema se reduce a \u0027mptcp_frag_can_collapse_to()\u0027 suponiendo que s\u00f3lo MPTCP utilizar\u00e1 el page_frag dado. Si otros (por ejemplo, el protocolo TCP simple) asignan fragmentos de p\u00e1gina, podemos terminar reutilizando la memoria ya asignada para mptcp_data_frag. Solucione el problema asegur\u00e1ndose de que el fragmento de datos que se va a expandir est\u00e9 ubicado al final del fragmento de la p\u00e1gina actual. v1 -\u0026gt; v2: - se agreg\u00f3 la etiqueta de correcciones faltantes (Mat)"
          }
        ],
        "id": "CVE-2021-47152",
        "lastModified": "2026-08-04T10:16:48.963",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47152",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:54:51.146188Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-03-25T09:15:09.357",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:06:08+00:00",
      "cve": "CVE-2021-47152",
      "id": "CVE-2021-47152",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "16",
      "product_status:known_not_affected": "182",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: fix data stream corruption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47152.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T23:43:45Z",
      "cve": "CVE-2021-47152",
      "id": "CVE-2021-47152",
      "initial_release_date": "2024-03-27T04:26:00Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47152",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47152.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:24:39.850Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47152",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:54:51.146188Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:19.670Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/mptcp/protocol.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "3267a061096efc91eda52c2a0c61ba76e46e4b34",
                  "status": "affected",
                  "version": "18b683bff89d46ace55f12d00c0440d44d6160c4",
                  "versionType": "git"
                },
                {
                  "lessThan": "18e7f0580da15cac1e79d73683ada5a9e70980f8",
                  "status": "affected",
                  "version": "18b683bff89d46ace55f12d00c0440d44d6160c4",
                  "versionType": "git"
                },
                {
                  "lessThan": "29249eac5225429b898f278230a6ca2baa1ae154",
                  "status": "affected",
                  "version": "18b683bff89d46ace55f12d00c0440d44d6160c4",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/mptcp/protocol.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.7"
                },
                {
                  "lessThan": "5.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.42",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.12.*",
                  "status": "unaffected",
                  "version": "5.12.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.42",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.9",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix data stream corruption\n\nMaxim reported several issues when forcing a TCP transparent proxy\nto use the MPTCP protocol for the inbound connections. He also\nprovided a clean reproducer.\n\nThe problem boils down to \u0027mptcp_frag_can_collapse_to()\u0027 assuming\nthat only MPTCP will use the given page_frag.\n\nIf others - e.g. the plain TCP protocol - allocate page fragments,\nwe can end-up re-using already allocated memory for mptcp_data_frag.\n\nFix the issue ensuring that the to-be-expanded data fragment is\nlocated at the current page frag end.\n\nv1 -\u003e v2:\n - added missing fixes tag (Mat)"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is in mptcp_sendmsg\u2019s page_frag collapse/carve logic, reached via local sendmsg/sendto on an MPTCP socket (syscall path), not by parsing unsolicited received packets.\nAC:L - An unprivileged attacker who opens MPTCP (and/or TCP) sockets in one process fully controls shared current-\u003etask_frag interleaving and can reliably force the false collapse and overlapping reuse; no victim-only timing or layout is required.\nPR:L - Creating IPPROTO_MPTCP sockets needs only net.mptcp.enabled (default on when CONFIG_MPTCP is built); no CAP_NET_ADMIN or init-namespace root is required along the send path.\nUI:N - The attacker triggers the vulnerable sendmsg path themselves on their own sockets; no separate victim action is required.\nS:U - Impact is kernel memory/list corruption and DoS within the same host OS authority\u2014standard local kernel compromise, not a VM/IOMMU/sandbox boundary cross.\nC:H - False collapse lets attacker-controlled send data overwrite in-page mptcp_data_frag fields (page/offset/list); corrupted frags can then be transmitted via tcp_build_frag, and the heap/list corruption is further leverageable for disclosure.\nI:H - Overlapping writes corrupt adjacent mptcp_data_frag list_head and related state (CWE-787), enabling list_add/list_del corruption and arbitrary-write primitives as seen in the reported list_add BUG paths.\nA:H - The same corruption produced kernel BUG_ON list_add/list_del failures, soft lockups at 100% CPU, and host hangs/panics in the documented reproducer."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:46:20.724Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34"
            },
            {
              "url": "https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8"
            },
            {
              "url": "https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154"
            }
          ],
          "title": "mptcp: fix data stream corruption",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47152",
        "datePublished": "2024-03-25T09:07:47.235Z",
        "dateReserved": "2024-03-04T18:12:48.846Z",
        "dateUpdated": "2026-08-05T08:46:20.724Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.