CVE-2021-47162— tipc: skb_linearize the head skb when reassembling msgs
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-47162
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
tipc: skb_linearize the head skb when reassembling msgs
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: tipc: skb_linearize the head skb when reassembling msgs It's not a good idea to append the frag skb to a skb's frag_list if the frag_list already has skbs from elsewhere, such as this skb was created by pskb_copy() where the frag_list was cloned (all the skbs in it were skb_get'ed) and shared by multiple skbs. However, the new appended frag skb should have been only seen by the current skb. Otherwise, it will cause use after free crashes as this appended frag skb are seen by multiple skbs but it only got skb_get called once. The same thing happens with a skb updated by pskb_may_pull() with a skb_cloned skb. Li Shuang has reported quite a few crashes caused by this when doing testing over macvlan devices: [] kernel BUG at net/core/skbuff.c:1970! [] Call Trace: [] skb_clone+0x4d/0xb0 [] macvlan_broadcast+0xd8/0x160 [macvlan] [] macvlan_process_broadcast+0x148/0x150 [macvlan] [] process_one_work+0x1a7/0x360 [] worker_thread+0x30/0x390 [] kernel BUG at mm/usercopy.c:102! [] Call Trace: [] __check_heap_object+0xd3/0x100 [] __check_object_size+0xff/0x16b [] simple_copy_to_iter+0x1c/0x30 [] __skb_datagram_iter+0x7d/0x310 [] __skb_datagram_iter+0x2a5/0x310 [] skb_copy_datagram_iter+0x3b/0x90 [] tipc_recvmsg+0x14a/0x3a0 [tipc] [] ____sys_recvmsg+0x91/0x150 [] ___sys_recvmsg+0x7b/0xc0 [] kernel BUG at mm/slub.c:305! [] Call Trace: [] <IRQ> [] kmem_cache_free+0x3ff/0x400 [] __netif_receive_skb_core+0x12c/0xc40 [] ? kmem_cache_alloc+0x12e/0x270 [] netif_receive_skb_internal+0x3d/0xb0 [] ? get_rx_page_info+0x8e/0xa0 [be2net] [] be_poll+0x6ef/0xd00 [be2net] [] ? irq_exit+0x4f/0x100 [] net_rx_action+0x149/0x3b0 ... This patch is to fix it by linearizing the head skb if it has frag_list set in tipc_buf_append(). Note that we choose to do this before calling skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can not just drop the frag_list either as the early time.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于tipc中存在释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-47162
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47162
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-03-25 · 40 CVEs total
| CVE-2021-47171 | net: usb: fix memory leak in smsc75xx_bind | |
| CVE-2021-47161 | spi: spi-fsl-dspi: Fix a resource leak in an error handling path | |
| CVE-2021-47163 | tipc: wait and exit until all work queues are done | |
| CVE-2021-47164 | net/mlx5e: Fix null deref accessing lag dev | |
| CVE-2021-47165 | drm/meson: fix shutdown crash when component not probed | |
| CVE-2021-47166 | NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() | |
| CVE-2021-47167 | NFS: Fix an Oopsable condition in __nfs_pageio_add_request() | |
| CVE-2021-47168 | NFS: fix an incorrect limit in filelayout_decode_layout() | |
| CVE-2021-47169 | serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait' | |
| CVE-2021-47170 | USB: usbfs: Don't WARN about excessively large memory allocations | |
| CVE-2021-47160 | net: dsa: mt7530: fix VLAN traffic leaks | |
| CVE-2021-47172 | iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers | |
| CVE-2021-47173 | misc/uss720: fix memory leak in uss720_probe | |
| CVE-2021-47174 | netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version | |
| CVE-2021-47175 | net/sched: fq_pie: fix OOB access in the traffic path | |
| CVE-2021-47176 | s390/dasd: add missing discipline function | |
| CVE-2021-47177 | iommu/vt-d: Fix sysfs leak in alloc_iommu() | |
| CVE-2021-47178 | scsi: target: core: Avoid smp_processor_id() in preemptible code | |
| CVE-2021-47179 | NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() | |
| CVE-2021-47180 | NFC: nci: fix memory leak in nci_allocate_device |
Showing top 20 of 40 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2021-47162
No comments yet