CVE-2021-47243

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47243
In the Linux kernel, the following vulnerability has been resolved: sch_cake: Fix out of bounds when parsing TCP options and header The TCP option parser in cake qdisc (cake_get_tcpopt and cake_tcph_may_drop) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1. This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack out of bounds when parsing TCP options."). v2 changes: Added doff validation in cake_get_tcphdr to avoid parsing garbage as TCP header. Although it wasn't strictly an out-of-bounds access (memory was allocated), garbage values could be read where CAKE expected the TCP header if doff was smaller than 5.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f Patch
https://git.kernel.org/stable/c/3b491dd593d582ceeb27aa617600712a6bd14246 Patch
https://git.kernel.org/stable/c/4cefa061fc63f4d2dff5ab4083f43857cd7a2335 Patch
https://git.kernel.org/stable/c/595897ef118d6fe66690c4fc5b572028c9da95b7 Patch
https://git.kernel.org/stable/c/ba91c49dedbde758ba0b72f57ac90b06ddf8e548 Patch
https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f Patch
https://git.kernel.org/stable/c/3b491dd593d582ceeb27aa617600712a6bd14246 Patch
https://git.kernel.org/stable/c/4cefa061fc63f4d2dff5ab4083f43857cd7a2335 Patch
https://git.kernel.org/stable/c/595897ef118d6fe66690c4fc5b572028c9da95b7 Patch
https://git.kernel.org/stable/c/ba91c49dedbde758ba0b72f57ac90b06ddf8e548 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*
History

30 Dec 2024, 19:04

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f - () https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f - Patch
References () https://git.kernel.org/stable/c/3b491dd593d582ceeb27aa617600712a6bd14246 - () https://git.kernel.org/stable/c/3b491dd593d582ceeb27aa617600712a6bd14246 - Patch
References () https://git.kernel.org/stable/c/4cefa061fc63f4d2dff5ab4083f43857cd7a2335 - () https://git.kernel.org/stable/c/4cefa061fc63f4d2dff5ab4083f43857cd7a2335 - Patch
References () https://git.kernel.org/stable/c/595897ef118d6fe66690c4fc5b572028c9da95b7 - () https://git.kernel.org/stable/c/595897ef118d6fe66690c4fc5b572028c9da95b7 - Patch
References () https://git.kernel.org/stable/c/ba91c49dedbde758ba0b72f57ac90b06ddf8e548 - () https://git.kernel.org/stable/c/ba91c49dedbde758ba0b72f57ac90b06ddf8e548 - Patch
CWE CWE-125
CPE cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1

21 Nov 2024, 06:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f - () https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f -
References () https://git.kernel.org/stable/c/3b491dd593d582ceeb27aa617600712a6bd14246 - () https://git.kernel.org/stable/c/3b491dd593d582ceeb27aa617600712a6bd14246 -
References () https://git.kernel.org/stable/c/4cefa061fc63f4d2dff5ab4083f43857cd7a2335 - () https://git.kernel.org/stable/c/4cefa061fc63f4d2dff5ab4083f43857cd7a2335 -
References () https://git.kernel.org/stable/c/595897ef118d6fe66690c4fc5b572028c9da95b7 - () https://git.kernel.org/stable/c/595897ef118d6fe66690c4fc5b572028c9da95b7 -
References () https://git.kernel.org/stable/c/ba91c49dedbde758ba0b72f57ac90b06ddf8e548 - () https://git.kernel.org/stable/c/ba91c49dedbde758ba0b72f57ac90b06ddf8e548 -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: sch_cake: Corrección de límites al analizar las opciones TCP y el encabezado. El analizador de opciones TCP en cake qdisc (cake_get_tcpopt y cake_tcph_may_drop) podía leer un byte fuera de los límites. Cuando la longitud es 1, el flujo de ejecución entra en el bucle, lee un byte del código de operación y, si el código de operación no es TCPOPT_EOL ni TCPOPT_NOP, lee un byte más, que excede la longitud de 1. Esta solución está inspirada en la confirmación. 9609dad263f8 ("ipv4: tcp_input: corrige la pila fuera de los límites al analizar las opciones de TCP"). Cambios en v2: Se agregó validación de doff en cake_get_tcphdr para evitar analizar basura como encabezado TCP. Aunque no era estrictamente un acceso fuera de los límites (se asignó memoria), se podían leer valores basura donde CAKE esperaba el encabezado TCP si doff era menor que 5.

21 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-21 15:15

Updated : 2024-12-30 19:04

NVD link : CVE-2021-47243

Mitre link : CVE-2021-47243

CVE.ORG link : CVE-2021-47243

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read