CVE-2021-47557 (GCVE-0-2021-47557)

Vulnerability from cvelistv5 – Published: 2024-05-24 15:09 – Updated: 2026-05-11 13:56
VLAI?
Title
net/sched: sch_ets: don't peek at classes beyond 'nbands'
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_ets: don't peek at classes beyond 'nbands' when the number of DRR classes decreases, the round-robin active list can contain elements that have already been freed in ets_qdisc_change(). As a consequence, it's possible to see a NULL dereference crash, caused by the attempt to call cl->qdisc->ops->peek(cl->qdisc) when cl->qdisc is NULL: BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 910 Comm: mausezahn Not tainted 5.16.0-rc1+ #475 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 RIP: 0010:ets_qdisc_dequeue+0x129/0x2c0 [sch_ets] Code: c5 01 41 39 ad e4 02 00 00 0f 87 18 ff ff ff 49 8b 85 c0 02 00 00 49 39 c4 0f 84 ba 00 00 00 49 8b ad c0 02 00 00 48 8b 7d 10 <48> 8b 47 18 48 8b 40 38 0f ae e8 ff d0 48 89 c3 48 85 c0 0f 84 9d RSP: 0000:ffffbb36c0b5fdd8 EFLAGS: 00010287 RAX: ffff956678efed30 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000002 RSI: ffffffff9b938dc9 RDI: 0000000000000000 RBP: ffff956678efed30 R08: e2f3207fe360129c R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff956678efeac0 R13: ffff956678efe800 R14: ffff956611545000 R15: ffff95667ac8f100 FS: 00007f2aa9120740(0000) GS:ffff95667b800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000011070c000 CR4: 0000000000350ee0 Call Trace: <TASK> qdisc_peek_dequeued+0x29/0x70 [sch_ets] tbf_dequeue+0x22/0x260 [sch_tbf] __qdisc_run+0x7f/0x630 net_tx_action+0x290/0x4c0 __do_softirq+0xee/0x4f8 irq_exit_rcu+0xf4/0x130 sysvec_apic_timer_interrupt+0x52/0xc0 asm_sysvec_apic_timer_interrupt+0x12/0x20 RIP: 0033:0x7f2aa7fc9ad4 Code: b9 ff ff 48 8b 54 24 18 48 83 c4 08 48 89 ee 48 89 df 5b 5d e9 ed fc ff ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa <53> 48 83 ec 10 48 8b 05 10 64 33 00 48 8b 00 48 85 c0 0f 85 84 00 RSP: 002b:00007ffe5d33fab8 EFLAGS: 00000202 RAX: 0000000000000002 RBX: 0000561f72c31460 RCX: 0000561f72c31720 RDX: 0000000000000002 RSI: 0000561f72c31722 RDI: 0000561f72c31720 RBP: 000000000000002a R08: 00007ffe5d33fa40 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 0000561f7187e380 R13: 0000000000000000 R14: 0000000000000000 R15: 0000561f72c31460 </TASK> Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt intel_rapl_msr iTCO_vendor_support intel_rapl_common joydev virtio_balloon lpc_ich i2c_i801 i2c_smbus pcspkr ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel serio_raw libata virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod CR2: 0000000000000018 Ensuring that 'alist' was never zeroed [1] was not sufficient, we need to remove from the active list those elements that are no more SP nor DRR. [1] https://lore.kernel.org/netdev/60d274838bf09777f0371253416e8af71360bc08.1633609148.git.dcaratti@redhat.com/ v3: fix race between ets_qdisc_change() and ets_qdisc_dequeue() delisting DRR classes beyond 'nbands' in ets_qdisc_change() with the qdisc lock acquired, thanks to Cong Wang. v2: when a NULL qdisc is found in the DRR active list, try to dequeue skb from the next list item.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 , < ae2659d2c670252759ee9c823c4e039c0e05a6f2 (git)
Affected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 , < e25bdbc7e951ae5728fee1f4c09485df113d013c (git)
Affected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 , < de6d25924c2a8c2988c6a385990cafbe742061bf (git)
Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.10.83 , ≤ 5.10.* (semver)
Unaffected: 5.15.6 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47557",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T19:15:45.533433Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:22.387Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.828Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ae2659d2c670252759ee9c823c4e039c0e05a6f2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e25bdbc7e951ae5728fee1f4c09485df113d013c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/de6d25924c2a8c2988c6a385990cafbe742061bf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_ets.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae2659d2c670252759ee9c823c4e039c0e05a6f2",
              "status": "affected",
              "version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
              "versionType": "git"
            },
            {
              "lessThan": "e25bdbc7e951ae5728fee1f4c09485df113d013c",
              "status": "affected",
              "version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
              "versionType": "git"
            },
            {
              "lessThan": "de6d25924c2a8c2988c6a385990cafbe742061bf",
              "status": "affected",
              "version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_ets.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.83",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.6",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_ets: don\u0027t peek at classes beyond \u0027nbands\u0027\n\nwhen the number of DRR classes decreases, the round-robin active list can\ncontain elements that have already been freed in ets_qdisc_change(). As a\nconsequence, it\u0027s possible to see a NULL dereference crash, caused by the\nattempt to call cl-\u003eqdisc-\u003eops-\u003epeek(cl-\u003eqdisc) when cl-\u003eqdisc is NULL:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 1 PID: 910 Comm: mausezahn Not tainted 5.16.0-rc1+ #475\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\n RIP: 0010:ets_qdisc_dequeue+0x129/0x2c0 [sch_ets]\n Code: c5 01 41 39 ad e4 02 00 00 0f 87 18 ff ff ff 49 8b 85 c0 02 00 00 49 39 c4 0f 84 ba 00 00 00 49 8b ad c0 02 00 00 48 8b 7d 10 \u003c48\u003e 8b 47 18 48 8b 40 38 0f ae e8 ff d0 48 89 c3 48 85 c0 0f 84 9d\n RSP: 0000:ffffbb36c0b5fdd8 EFLAGS: 00010287\n RAX: ffff956678efed30 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000002 RSI: ffffffff9b938dc9 RDI: 0000000000000000\n RBP: ffff956678efed30 R08: e2f3207fe360129c R09: 0000000000000000\n R10: 0000000000000001 R11: 0000000000000001 R12: ffff956678efeac0\n R13: ffff956678efe800 R14: ffff956611545000 R15: ffff95667ac8f100\n FS:  00007f2aa9120740(0000) GS:ffff95667b800000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000018 CR3: 000000011070c000 CR4: 0000000000350ee0\n Call Trace:\n  \u003cTASK\u003e\n  qdisc_peek_dequeued+0x29/0x70 [sch_ets]\n  tbf_dequeue+0x22/0x260 [sch_tbf]\n  __qdisc_run+0x7f/0x630\n  net_tx_action+0x290/0x4c0\n  __do_softirq+0xee/0x4f8\n  irq_exit_rcu+0xf4/0x130\n  sysvec_apic_timer_interrupt+0x52/0xc0\n  asm_sysvec_apic_timer_interrupt+0x12/0x20\n RIP: 0033:0x7f2aa7fc9ad4\n Code: b9 ff ff 48 8b 54 24 18 48 83 c4 08 48 89 ee 48 89 df 5b 5d e9 ed fc ff ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa \u003c53\u003e 48 83 ec 10 48 8b 05 10 64 33 00 48 8b 00 48 85 c0 0f 85 84 00\n RSP: 002b:00007ffe5d33fab8 EFLAGS: 00000202\n RAX: 0000000000000002 RBX: 0000561f72c31460 RCX: 0000561f72c31720\n RDX: 0000000000000002 RSI: 0000561f72c31722 RDI: 0000561f72c31720\n RBP: 000000000000002a R08: 00007ffe5d33fa40 R09: 0000000000000014\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000561f7187e380\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000561f72c31460\n  \u003c/TASK\u003e\n Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt intel_rapl_msr iTCO_vendor_support intel_rapl_common joydev virtio_balloon lpc_ich i2c_i801 i2c_smbus pcspkr ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel serio_raw libata virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod\n CR2: 0000000000000018\n\nEnsuring that \u0027alist\u0027 was never zeroed [1] was not sufficient, we need to\nremove from the active list those elements that are no more SP nor DRR.\n\n[1] https://lore.kernel.org/netdev/60d274838bf09777f0371253416e8af71360bc08.1633609148.git.dcaratti@redhat.com/\n\nv3: fix race between ets_qdisc_change() and ets_qdisc_dequeue() delisting\n    DRR classes beyond \u0027nbands\u0027 in ets_qdisc_change() with the qdisc lock\n    acquired, thanks to Cong Wang.\n\nv2: when a NULL qdisc is found in the DRR active list, try to dequeue skb\n    from the next list item."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:56:55.850Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae2659d2c670252759ee9c823c4e039c0e05a6f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/e25bdbc7e951ae5728fee1f4c09485df113d013c"
        },
        {
          "url": "https://git.kernel.org/stable/c/de6d25924c2a8c2988c6a385990cafbe742061bf"
        }
      ],
      "title": "net/sched: sch_ets: don\u0027t peek at classes beyond \u0027nbands\u0027",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47557",
    "datePublished": "2024-05-24T15:09:58.655Z",
    "dateReserved": "2024-05-24T15:02:54.834Z",
    "dateUpdated": "2026-05-11T13:56:55.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47557",
      "date": "2026-05-21",
      "epss": "0.00012",
      "percentile": "0.01755"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.6\", \"versionEndExcluding\": \"5.10.83\", \"matchCriteriaId\": \"090CC6D1-5E7F-49F4-A646-1973F554E9DD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.6\", \"matchCriteriaId\": \"990C08FB-0121-4296-896F-556312F8FF3B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"357AA433-37E8-4323-BFB2-3038D6E4B414\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"A73429BA-C2D9-4D0C-A75F-06A1CA8B3983\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: sch_ets: don\u0027t peek at classes beyond \u0027nbands\u0027\\n\\nwhen the number of DRR classes decreases, the round-robin active list can\\ncontain elements that have already been freed in ets_qdisc_change(). As a\\nconsequence, it\u0027s possible to see a NULL dereference crash, caused by the\\nattempt to call cl-\u003eqdisc-\u003eops-\u003epeek(cl-\u003eqdisc) when cl-\u003eqdisc is NULL:\\n\\n BUG: kernel NULL pointer dereference, address: 0000000000000018\\n #PF: supervisor read access in kernel mode\\n #PF: error_code(0x0000) - not-present page\\n PGD 0 P4D 0\\n Oops: 0000 [#1] PREEMPT SMP NOPTI\\n CPU: 1 PID: 910 Comm: mausezahn Not tainted 5.16.0-rc1+ #475\\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\\n RIP: 0010:ets_qdisc_dequeue+0x129/0x2c0 [sch_ets]\\n Code: c5 01 41 39 ad e4 02 00 00 0f 87 18 ff ff ff 49 8b 85 c0 02 00 00 49 39 c4 0f 84 ba 00 00 00 49 8b ad c0 02 00 00 48 8b 7d 10 \u003c48\u003e 8b 47 18 48 8b 40 38 0f ae e8 ff d0 48 89 c3 48 85 c0 0f 84 9d\\n RSP: 0000:ffffbb36c0b5fdd8 EFLAGS: 00010287\\n RAX: ffff956678efed30 RBX: 0000000000000000 RCX: 0000000000000000\\n RDX: 0000000000000002 RSI: ffffffff9b938dc9 RDI: 0000000000000000\\n RBP: ffff956678efed30 R08: e2f3207fe360129c R09: 0000000000000000\\n R10: 0000000000000001 R11: 0000000000000001 R12: ffff956678efeac0\\n R13: ffff956678efe800 R14: ffff956611545000 R15: ffff95667ac8f100\\n FS:  00007f2aa9120740(0000) GS:ffff95667b800000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 0000000000000018 CR3: 000000011070c000 CR4: 0000000000350ee0\\n Call Trace:\\n  \u003cTASK\u003e\\n  qdisc_peek_dequeued+0x29/0x70 [sch_ets]\\n  tbf_dequeue+0x22/0x260 [sch_tbf]\\n  __qdisc_run+0x7f/0x630\\n  net_tx_action+0x290/0x4c0\\n  __do_softirq+0xee/0x4f8\\n  irq_exit_rcu+0xf4/0x130\\n  sysvec_apic_timer_interrupt+0x52/0xc0\\n  asm_sysvec_apic_timer_interrupt+0x12/0x20\\n RIP: 0033:0x7f2aa7fc9ad4\\n Code: b9 ff ff 48 8b 54 24 18 48 83 c4 08 48 89 ee 48 89 df 5b 5d e9 ed fc ff ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa \u003c53\u003e 48 83 ec 10 48 8b 05 10 64 33 00 48 8b 00 48 85 c0 0f 85 84 00\\n RSP: 002b:00007ffe5d33fab8 EFLAGS: 00000202\\n RAX: 0000000000000002 RBX: 0000561f72c31460 RCX: 0000561f72c31720\\n RDX: 0000000000000002 RSI: 0000561f72c31722 RDI: 0000561f72c31720\\n RBP: 000000000000002a R08: 00007ffe5d33fa40 R09: 0000000000000014\\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000561f7187e380\\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000561f72c31460\\n  \u003c/TASK\u003e\\n Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt intel_rapl_msr iTCO_vendor_support intel_rapl_common joydev virtio_balloon lpc_ich i2c_i801 i2c_smbus pcspkr ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel serio_raw libata virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod\\n CR2: 0000000000000018\\n\\nEnsuring that \u0027alist\u0027 was never zeroed [1] was not sufficient, we need to\\nremove from the active list those elements that are no more SP nor DRR.\\n\\n[1] https://lore.kernel.org/netdev/60d274838bf09777f0371253416e8af71360bc08.1633609148.git.dcaratti@redhat.com/\\n\\nv3: fix race between ets_qdisc_change() and ets_qdisc_dequeue() delisting\\n    DRR classes beyond \u0027nbands\u0027 in ets_qdisc_change() with the qdisc lock\\n    acquired, thanks to Cong Wang.\\n\\nv2: when a NULL qdisc is found in the DRR active list, try to dequeue skb\\n    from the next list item.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: sch_ets: no mire las clases m\\u00e1s all\\u00e1 de \u0027nbands\u0027 cuando el n\\u00famero de clases DRR disminuye, la lista activa por turnos puede contener elementos que ya han sido liberados en ets_qdisc_change(). Como consecuencia, es posible ver un bloqueo de desreferencia NULL, causado por el intento de llamar a cl-\u0026gt;qdisc-\u0026gt;ops-\u0026gt;peek(cl-\u0026gt;qdisc) cuando cl-\u0026gt;qdisc es NULL: ERROR: desreferencia del puntero NULL del kernel, direcci\\u00f3n: 0000000000000018 #PF: acceso de lectura del supervisor en modo kernel #PF: error_code(0x0000) - p\\u00e1gina no presente PGD 0 P4D 0 Ups: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 910 Comm: mausezahn Not tainted 5.16 .0-rc1+ #475 Nombre de hardware: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 01/04/2014 RIP: 0010:ets_qdisc_dequeue+0x129/0x2c0 [sch_ets] C\\u00f3digo: c5 01 41 39 ad e4 02 00 00 0f 87 18 ff ff ff 49 8b 85 c0 02 00 00 49 39 c4 0f 84 ba 00 00 00 49 8b ad c0 02 00 00 48 8b 7d 10 \u0026lt;48\u0026gt; 8b 47 48 8b 40 38 0f ae e8 ff d0 48 89 c3 48 85 c0 0f 84 9d RSP: 0000:ffffbb36c0b5fdd8 EFLAGS: 00010287 RAX: ffff956678efed30 RBX: 0000000000000000 RCX: 00000000000 00000 RDX: 0000000000000002 RSI: ffffffff9b938dc9 RDI: 0000000000000000 RBP: ffff956678efed30 R08: e2f3207fe360129c R09: 000000000000000000000 R10 : 0000000000000001 R11: 0000000000000001 R12: ffff956678efeac0 R13: ffff956678efe800 R14: ffff956611545000 R15: ffff95667ac8f100 FS: a9120740(0000) GS:ffff95667b800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 0000011070c000 CR4: 0000000000350ee0 Seguimiento de llamadas:  qdisc_peek_dequeued+0x29/0x70 [sch_ets] tbf_dequeue+0x22/0x260 [sch_tbf] __qdisc_run+0x7f/0x630 net_tx_action+0x290/0x4c0 ee/0x4f8 irq_exit_rcu+0xf4/0x130 sysvec_apic_timer_interrupt+0x52/0xc0 asm_sysvec_apic_timer_interrupt+0x12/0x20 RIP: 0033:0x7f2aa7fc9ad4 C\\u00f3digo: b9 ff ff 48 8b 54 24 18 48 83 c4 08 48 89 ee 48 89 df 5b 5d e9 ed fc ff ff 0f 1f 0 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa \u0026lt;53\u0026gt; 48 83 ec 10 48 8b 05 10 64 33 00 48 8b 00 48 85 c0 0f 85 84 00 RSP: 002b:00007ffe5d33fab8 EFLAGS: 00000202 RAX: 0000002 RBX: 0000561f72c31460 RCX: 0000561f72c31720 RDX: 0000000000000002 RSI: 0000561f72c31722 RDI: 0000561f72c31720 RBP: 000000000000002a R08: 00007ffe5d33fa40 R09: 00000000000000014 R10: 0000000000000000 R11: 000000000000246 R12: 0000561f7187e380 R13: 0000000000000000 R14: 0000000000000000 R15: 0000561f72c31460  M\\u00f3dulos vinculados en: sch_ets sch_tbf dummy matar iTCO_wdt intel_rapl_msr iTCO_vendor_support intel_rapl_common joydev virtio_balloon lpc_ich i2c_i801 i2c_smbus pcspkr ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel serio_raw libata virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm _log dm_mod CR2: 0000000000000018 Asegurarse de que \u0027alist\u0027 nunca se pusiera a cero [1] no fue suficiente, debemos eliminarlo de la lista activa aquellos elementos que ya no son PS ni RRD. [1] https://lore.kernel.org/netdev/60d274838bf09777f0371253416e8af71360bc08.1633609148.git.dcaratti@redhat.com/ v3: corrige la ejecuci\\u00f3n entre ets_qdisc_change() y ets_qdisc_dequeue() eliminando las clases de DRR m\\u00e1s all\\u00e1 de \u0027nbands\u0027 en c_cambio() con el bloqueo qdisc adquirido, gracias a Cong Wang. v2: cuando se encuentra una qdisc NULL en la lista activa de DRR, intente sacar de la cola a skb del siguiente elemento de la lista.\"}]",
      "id": "CVE-2021-47557",
      "lastModified": "2025-01-06T20:47:21.047",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-24T15:15:20.393",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/ae2659d2c670252759ee9c823c4e039c0e05a6f2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/de6d25924c2a8c2988c6a385990cafbe742061bf\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e25bdbc7e951ae5728fee1f4c09485df113d013c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ae2659d2c670252759ee9c823c4e039c0e05a6f2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/de6d25924c2a8c2988c6a385990cafbe742061bf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e25bdbc7e951ae5728fee1f4c09485df113d013c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47557\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-24T15:15:20.393\",\"lastModified\":\"2025-01-06T20:47:21.047\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: sch_ets: don\u0027t peek at classes beyond \u0027nbands\u0027\\n\\nwhen the number of DRR classes decreases, the round-robin active list can\\ncontain elements that have already been freed in ets_qdisc_change(). As a\\nconsequence, it\u0027s possible to see a NULL dereference crash, caused by the\\nattempt to call cl-\u003eqdisc-\u003eops-\u003epeek(cl-\u003eqdisc) when cl-\u003eqdisc is NULL:\\n\\n BUG: kernel NULL pointer dereference, address: 0000000000000018\\n #PF: supervisor read access in kernel mode\\n #PF: error_code(0x0000) - not-present page\\n PGD 0 P4D 0\\n Oops: 0000 [#1] PREEMPT SMP NOPTI\\n CPU: 1 PID: 910 Comm: mausezahn Not tainted 5.16.0-rc1+ #475\\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\\n RIP: 0010:ets_qdisc_dequeue+0x129/0x2c0 [sch_ets]\\n Code: c5 01 41 39 ad e4 02 00 00 0f 87 18 ff ff ff 49 8b 85 c0 02 00 00 49 39 c4 0f 84 ba 00 00 00 49 8b ad c0 02 00 00 48 8b 7d 10 \u003c48\u003e 8b 47 18 48 8b 40 38 0f ae e8 ff d0 48 89 c3 48 85 c0 0f 84 9d\\n RSP: 0000:ffffbb36c0b5fdd8 EFLAGS: 00010287\\n RAX: ffff956678efed30 RBX: 0000000000000000 RCX: 0000000000000000\\n RDX: 0000000000000002 RSI: ffffffff9b938dc9 RDI: 0000000000000000\\n RBP: ffff956678efed30 R08: e2f3207fe360129c R09: 0000000000000000\\n R10: 0000000000000001 R11: 0000000000000001 R12: ffff956678efeac0\\n R13: ffff956678efe800 R14: ffff956611545000 R15: ffff95667ac8f100\\n FS:  00007f2aa9120740(0000) GS:ffff95667b800000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 0000000000000018 CR3: 000000011070c000 CR4: 0000000000350ee0\\n Call Trace:\\n  \u003cTASK\u003e\\n  qdisc_peek_dequeued+0x29/0x70 [sch_ets]\\n  tbf_dequeue+0x22/0x260 [sch_tbf]\\n  __qdisc_run+0x7f/0x630\\n  net_tx_action+0x290/0x4c0\\n  __do_softirq+0xee/0x4f8\\n  irq_exit_rcu+0xf4/0x130\\n  sysvec_apic_timer_interrupt+0x52/0xc0\\n  asm_sysvec_apic_timer_interrupt+0x12/0x20\\n RIP: 0033:0x7f2aa7fc9ad4\\n Code: b9 ff ff 48 8b 54 24 18 48 83 c4 08 48 89 ee 48 89 df 5b 5d e9 ed fc ff ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa \u003c53\u003e 48 83 ec 10 48 8b 05 10 64 33 00 48 8b 00 48 85 c0 0f 85 84 00\\n RSP: 002b:00007ffe5d33fab8 EFLAGS: 00000202\\n RAX: 0000000000000002 RBX: 0000561f72c31460 RCX: 0000561f72c31720\\n RDX: 0000000000000002 RSI: 0000561f72c31722 RDI: 0000561f72c31720\\n RBP: 000000000000002a R08: 00007ffe5d33fa40 R09: 0000000000000014\\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000561f7187e380\\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000561f72c31460\\n  \u003c/TASK\u003e\\n Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt intel_rapl_msr iTCO_vendor_support intel_rapl_common joydev virtio_balloon lpc_ich i2c_i801 i2c_smbus pcspkr ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel serio_raw libata virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod\\n CR2: 0000000000000018\\n\\nEnsuring that \u0027alist\u0027 was never zeroed [1] was not sufficient, we need to\\nremove from the active list those elements that are no more SP nor DRR.\\n\\n[1] https://lore.kernel.org/netdev/60d274838bf09777f0371253416e8af71360bc08.1633609148.git.dcaratti@redhat.com/\\n\\nv3: fix race between ets_qdisc_change() and ets_qdisc_dequeue() delisting\\n    DRR classes beyond \u0027nbands\u0027 in ets_qdisc_change() with the qdisc lock\\n    acquired, thanks to Cong Wang.\\n\\nv2: when a NULL qdisc is found in the DRR active list, try to dequeue skb\\n    from the next list item.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: sch_ets: no mire las clases m\u00e1s all\u00e1 de \u0027nbands\u0027 cuando el n\u00famero de clases DRR disminuye, la lista activa por turnos puede contener elementos que ya han sido liberados en ets_qdisc_change(). Como consecuencia, es posible ver un bloqueo de desreferencia NULL, causado por el intento de llamar a cl-\u0026gt;qdisc-\u0026gt;ops-\u0026gt;peek(cl-\u0026gt;qdisc) cuando cl-\u0026gt;qdisc es NULL: ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 0000000000000018 #PF: acceso de lectura del supervisor en modo kernel #PF: error_code(0x0000) - p\u00e1gina no presente PGD 0 P4D 0 Ups: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 910 Comm: mausezahn Not tainted 5.16 .0-rc1+ #475 Nombre de hardware: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 01/04/2014 RIP: 0010:ets_qdisc_dequeue+0x129/0x2c0 [sch_ets] C\u00f3digo: c5 01 41 39 ad e4 02 00 00 0f 87 18 ff ff ff 49 8b 85 c0 02 00 00 49 39 c4 0f 84 ba 00 00 00 49 8b ad c0 02 00 00 48 8b 7d 10 \u0026lt;48\u0026gt; 8b 47 48 8b 40 38 0f ae e8 ff d0 48 89 c3 48 85 c0 0f 84 9d RSP: 0000:ffffbb36c0b5fdd8 EFLAGS: 00010287 RAX: ffff956678efed30 RBX: 0000000000000000 RCX: 00000000000 00000 RDX: 0000000000000002 RSI: ffffffff9b938dc9 RDI: 0000000000000000 RBP: ffff956678efed30 R08: e2f3207fe360129c R09: 000000000000000000000 R10 : 0000000000000001 R11: 0000000000000001 R12: ffff956678efeac0 R13: ffff956678efe800 R14: ffff956611545000 R15: ffff95667ac8f100 FS: a9120740(0000) GS:ffff95667b800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 0000011070c000 CR4: 0000000000350ee0 Seguimiento de llamadas:  qdisc_peek_dequeued+0x29/0x70 [sch_ets] tbf_dequeue+0x22/0x260 [sch_tbf] __qdisc_run+0x7f/0x630 net_tx_action+0x290/0x4c0 ee/0x4f8 irq_exit_rcu+0xf4/0x130 sysvec_apic_timer_interrupt+0x52/0xc0 asm_sysvec_apic_timer_interrupt+0x12/0x20 RIP: 0033:0x7f2aa7fc9ad4 C\u00f3digo: b9 ff ff 48 8b 54 24 18 48 83 c4 08 48 89 ee 48 89 df 5b 5d e9 ed fc ff ff 0f 1f 0 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa \u0026lt;53\u0026gt; 48 83 ec 10 48 8b 05 10 64 33 00 48 8b 00 48 85 c0 0f 85 84 00 RSP: 002b:00007ffe5d33fab8 EFLAGS: 00000202 RAX: 0000002 RBX: 0000561f72c31460 RCX: 0000561f72c31720 RDX: 0000000000000002 RSI: 0000561f72c31722 RDI: 0000561f72c31720 RBP: 000000000000002a R08: 00007ffe5d33fa40 R09: 00000000000000014 R10: 0000000000000000 R11: 000000000000246 R12: 0000561f7187e380 R13: 0000000000000000 R14: 0000000000000000 R15: 0000561f72c31460  M\u00f3dulos vinculados en: sch_ets sch_tbf dummy matar iTCO_wdt intel_rapl_msr iTCO_vendor_support intel_rapl_common joydev virtio_balloon lpc_ich i2c_i801 i2c_smbus pcspkr ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel serio_raw libata virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm _log dm_mod CR2: 0000000000000018 Asegurarse de que \u0027alist\u0027 nunca se pusiera a cero [1] no fue suficiente, debemos eliminarlo de la lista activa aquellos elementos que ya no son PS ni RRD. [1] https://lore.kernel.org/netdev/60d274838bf09777f0371253416e8af71360bc08.1633609148.git.dcaratti@redhat.com/ v3: corrige la ejecuci\u00f3n entre ets_qdisc_change() y ets_qdisc_dequeue() eliminando las clases de DRR m\u00e1s all\u00e1 de \u0027nbands\u0027 en c_cambio() con el bloqueo qdisc adquirido, gracias a Cong Wang. v2: cuando se encuentra una qdisc NULL en la lista activa de DRR, intente sacar de la cola a skb del siguiente elemento de la lista.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.6\",\"versionEndExcluding\":\"5.10.83\",\"matchCriteriaId\":\"090CC6D1-5E7F-49F4-A646-1973F554E9DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.6\",\"matchCriteriaId\":\"990C08FB-0121-4296-896F-556312F8FF3B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A73429BA-C2D9-4D0C-A75F-06A1CA8B3983\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/ae2659d2c670252759ee9c823c4e039c0e05a6f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/de6d25924c2a8c2988c6a385990cafbe742061bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e25bdbc7e951ae5728fee1f4c09485df113d013c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae2659d2c670252759ee9c823c4e039c0e05a6f2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/de6d25924c2a8c2988c6a385990cafbe742061bf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e25bdbc7e951ae5728fee1f4c09485df113d013c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ae2659d2c670252759ee9c823c4e039c0e05a6f2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e25bdbc7e951ae5728fee1f4c09485df113d013c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/de6d25924c2a8c2988c6a385990cafbe742061bf\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.828Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47557\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-24T19:15:45.533433Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-24T19:15:49.408Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"net/sched: sch_ets: don\u0027t peek at classes beyond \u0027nbands\u0027\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33\", \"lessThan\": \"ae2659d2c670252759ee9c823c4e039c0e05a6f2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33\", \"lessThan\": \"e25bdbc7e951ae5728fee1f4c09485df113d013c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33\", \"lessThan\": \"de6d25924c2a8c2988c6a385990cafbe742061bf\", \"versionType\": \"git\"}], \"programFiles\": [\"net/sched/sch_ets.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/sched/sch_ets.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ae2659d2c670252759ee9c823c4e039c0e05a6f2\"}, {\"url\": \"https://git.kernel.org/stable/c/e25bdbc7e951ae5728fee1f4c09485df113d013c\"}, {\"url\": \"https://git.kernel.org/stable/c/de6d25924c2a8c2988c6a385990cafbe742061bf\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: sch_ets: don\u0027t peek at classes beyond \u0027nbands\u0027\\n\\nwhen the number of DRR classes decreases, the round-robin active list can\\ncontain elements that have already been freed in ets_qdisc_change(). As a\\nconsequence, it\u0027s possible to see a NULL dereference crash, caused by the\\nattempt to call cl-\u003eqdisc-\u003eops-\u003epeek(cl-\u003eqdisc) when cl-\u003eqdisc is NULL:\\n\\n BUG: kernel NULL pointer dereference, address: 0000000000000018\\n #PF: supervisor read access in kernel mode\\n #PF: error_code(0x0000) - not-present page\\n PGD 0 P4D 0\\n Oops: 0000 [#1] PREEMPT SMP NOPTI\\n CPU: 1 PID: 910 Comm: mausezahn Not tainted 5.16.0-rc1+ #475\\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\\n RIP: 0010:ets_qdisc_dequeue+0x129/0x2c0 [sch_ets]\\n Code: c5 01 41 39 ad e4 02 00 00 0f 87 18 ff ff ff 49 8b 85 c0 02 00 00 49 39 c4 0f 84 ba 00 00 00 49 8b ad c0 02 00 00 48 8b 7d 10 \u003c48\u003e 8b 47 18 48 8b 40 38 0f ae e8 ff d0 48 89 c3 48 85 c0 0f 84 9d\\n RSP: 0000:ffffbb36c0b5fdd8 EFLAGS: 00010287\\n RAX: ffff956678efed30 RBX: 0000000000000000 RCX: 0000000000000000\\n RDX: 0000000000000002 RSI: ffffffff9b938dc9 RDI: 0000000000000000\\n RBP: ffff956678efed30 R08: e2f3207fe360129c R09: 0000000000000000\\n R10: 0000000000000001 R11: 0000000000000001 R12: ffff956678efeac0\\n R13: ffff956678efe800 R14: ffff956611545000 R15: ffff95667ac8f100\\n FS:  00007f2aa9120740(0000) GS:ffff95667b800000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 0000000000000018 CR3: 000000011070c000 CR4: 0000000000350ee0\\n Call Trace:\\n  \u003cTASK\u003e\\n  qdisc_peek_dequeued+0x29/0x70 [sch_ets]\\n  tbf_dequeue+0x22/0x260 [sch_tbf]\\n  __qdisc_run+0x7f/0x630\\n  net_tx_action+0x290/0x4c0\\n  __do_softirq+0xee/0x4f8\\n  irq_exit_rcu+0xf4/0x130\\n  sysvec_apic_timer_interrupt+0x52/0xc0\\n  asm_sysvec_apic_timer_interrupt+0x12/0x20\\n RIP: 0033:0x7f2aa7fc9ad4\\n Code: b9 ff ff 48 8b 54 24 18 48 83 c4 08 48 89 ee 48 89 df 5b 5d e9 ed fc ff ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa \u003c53\u003e 48 83 ec 10 48 8b 05 10 64 33 00 48 8b 00 48 85 c0 0f 85 84 00\\n RSP: 002b:00007ffe5d33fab8 EFLAGS: 00000202\\n RAX: 0000000000000002 RBX: 0000561f72c31460 RCX: 0000561f72c31720\\n RDX: 0000000000000002 RSI: 0000561f72c31722 RDI: 0000561f72c31720\\n RBP: 000000000000002a R08: 00007ffe5d33fa40 R09: 0000000000000014\\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000561f7187e380\\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000561f72c31460\\n  \u003c/TASK\u003e\\n Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt intel_rapl_msr iTCO_vendor_support intel_rapl_common joydev virtio_balloon lpc_ich i2c_i801 i2c_smbus pcspkr ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel serio_raw libata virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod\\n CR2: 0000000000000018\\n\\nEnsuring that \u0027alist\u0027 was never zeroed [1] was not sufficient, we need to\\nremove from the active list those elements that are no more SP nor DRR.\\n\\n[1] https://lore.kernel.org/netdev/60d274838bf09777f0371253416e8af71360bc08.1633609148.git.dcaratti@redhat.com/\\n\\nv3: fix race between ets_qdisc_change() and ets_qdisc_dequeue() delisting\\n    DRR classes beyond \u0027nbands\u0027 in ets_qdisc_change() with the qdisc lock\\n    acquired, thanks to Cong Wang.\\n\\nv2: when a NULL qdisc is found in the DRR active list, try to dequeue skb\\n    from the next list item.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.83\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.6\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T13:56:55.850Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47557\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T13:56:55.850Z\", \"dateReserved\": \"2024-05-24T15:02:54.834Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-24T15:09:58.655Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.