Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

CVE-2021-47515— seg6: fix the iif in the IPv6 socket control block

EPSS 0.01% · P3

Affected Version Matrix 15

VendorProductVersion RangeStatus
LinuxLinuxc630ec8bdadae9d557b1ceb9d6c06e149108a0d4< b16d412e5f79734033df04e97d7ea2f50a8e9fe3affected
2f704348c93ff8119e642dae6a72327f90b82810< 6431e71093f3da586a00c6d931481ffb0dc2db0eaffected
ef489749aae508e6f17886775c075f12ff919fb1< ef8804e47c0a44ae106ead1740408af5ea6c6ee9affected
ef489749aae508e6f17886775c075f12ff919fb1< 666521b3852d2b2f52d570f9122b1e4b50d96831affected
ef489749aae508e6f17886775c075f12ff919fb1< 98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1affected
ef489749aae508e6f17886775c075f12ff919fb1< ae68d93354e5bf5191ee673982251864ea24dd5caffected
b71b7e0280f47b4ac633fbfd153423814ea87810affected
5.0affected
… +7 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2021-47515

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
seg6: fix the iif in the IPv6 socket control block
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: seg6: fix the iif in the IPv6 socket control block When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving interface index into the IPv4 socket control block (v5.16-rc4, net/ipv4/ip_input.c line 510): IPCB(skb)->iif = skb->skb_iif; If that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH header, the seg6_do_srh_encap(...) performs the required encapsulation. In this case, the seg6_do_srh_encap function clears the IPv6 socket control block (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163): memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); The memset(...) was introduced in commit ef489749aae5 ("ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation") a long time ago (2019-01-29). Since the IPv6 socket control block and the IPv4 socket control block share the same memory area (skb->cb), the receiving interface index info is lost (IP6CB(skb)->iif is set to zero). As a side effect, that condition triggers a NULL pointer dereference if commit 0857d6f8c759 ("ipv6: When forwarding count rx stats on the orig netdev") is applied. To fix that issue, we set the IP6CB(skb)->iif with the index of the receiving interface once again.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 seg6 模块 IPv6 套接字控制块中的 iif。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux c630ec8bdadae9d557b1ceb9d6c06e149108a0d4 ~ b16d412e5f79734033df04e97d7ea2f50a8e9fe3 -
LinuxLinux 5.0 -

II. Public POCs for CVE-2021-47515

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47515

请登录查看更多情报信息。

Same Patch Batch · Linux · 2024-05-24 · 73 CVEs total

CVE-2021-47549sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
CVE-2021-47569io_uring: fail cancellation for EXITING tasks
CVE-2021-47567powerpc/32: Fix hardlockup on vmap stack overflow
CVE-2021-47554vdpa_sim: avoid putting an uninitialized iova_domain
CVE-2021-47555net: vlan: fix underflow for the real_dev refcnt
CVE-2021-47553sched/scs: Reset task stack state in bringup_cpu()
CVE-2021-47551drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
CVE-2021-47552blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()
CVE-2021-47550drm/amd/amdgpu: fix potential memleak
CVE-2021-47548ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst
CVE-2021-47556ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
CVE-2021-47547net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound
CVE-2021-47546ipv6: fix memory leak in fib6_rule_suppress
CVE-2021-47544tcp: fix page frag corruption on page fault
CVE-2021-47542net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
CVE-2021-47541net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
CVE-2021-47540mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode
CVE-2021-47539rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
CVE-2021-47538rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
CVE-2021-47536net/smc: fix wrong list_del in smc_lgr_cleanup_early

Showing top 20 of 73 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47515

No comments yet

Leave a comment