CVE-2021-47515

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47515
In the Linux kernel, the following vulnerability has been resolved: seg6: fix the iif in the IPv6 socket control block When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving interface index into the IPv4 socket control block (v5.16-rc4, net/ipv4/ip_input.c line 510): IPCB(skb)->iif = skb->skb_iif; If that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH header, the seg6_do_srh_encap(...) performs the required encapsulation. In this case, the seg6_do_srh_encap function clears the IPv6 socket control block (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163): memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); The memset(...) was introduced in commit ef489749aae5 ("ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation") a long time ago (2019-01-29). Since the IPv6 socket control block and the IPv4 socket control block share the same memory area (skb->cb), the receiving interface index info is lost (IP6CB(skb)->iif is set to zero). As a side effect, that condition triggers a NULL pointer dereference if commit 0857d6f8c759 ("ipv6: When forwarding count rx stats on the orig netdev") is applied. To fix that issue, we set the IP6CB(skb)->iif with the index of the receiving interface once again.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e Patch
https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831 Patch
https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1 Patch
https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c Patch
https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3 Patch
https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9 Patch
https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e Patch
https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831 Patch
https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1 Patch
https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c Patch
https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3 Patch
https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*
History

24 Sep 2025, 19:37

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc6:*:*:*:*:*:*
CWE CWE-476
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e - () https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e - Patch
References () https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831 - () https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831 - Patch
References () https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1 - () https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1 - Patch
References () https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c - () https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c - Patch
References () https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3 - () https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3 - Patch
References () https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9 - () https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Nov 2024, 06:36

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e - () https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e -
References () https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831 - () https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831 -
References () https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1 - () https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1 -
References () https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c - () https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c -
References () https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3 - () https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3 -
References () https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9 - () https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: seg6: corrige el iif en el bloque de control del socket IPv6 Cuando se recibe un paquete IPv4, ip_rcv_core(...) establece el índice de la interfaz de recepción en el bloque de control del socket IPv4 (v5 .16-rc4, net/ipv4/ip_input.c línea 510): IPCB(skb)->iif = skb->skb_iif; Si ese paquete IPv4 debe encapsularse en un encabezado IPv6+SRH externo, seg6_do_srh_encap(...) realiza la encapsulación requerida. En este caso, la función seg6_do_srh_encap borra el bloque de control del socket IPv6 (v5.16-rc4 net/ipv6/seg6_iptunnel.c línea 163): memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); El memset(...) se introdujo en El commit ef489749aae5 ("ipv6: sr: clear IP6CB(skb) en la encapsulación SRH ip4ip6") hace mucho tiempo (29 de enero de 2019). Dado que el bloque de control del socket IPv6 y el bloque de control del socket IPv4 comparten la misma área de memoria (skb->cb), la información del índice de la interfaz de recepción se pierde (IP6CB(skb)->iif se establece en cero). Como efecto secundario, esa condición desencadena una desreferencia del puntero NULL si se aplica el commit 0857d6f8c759 ("ipv6: al reenviar estadísticas de recuento de rx en el netdev original"). Para solucionar ese problema, configuramos IP6CB(skb)->iif con el índice de la interfaz de recepción una vez más.

24 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-24 15:15

Updated : 2025-09-24 19:37

NVD link : CVE-2021-47515

Mitre link : CVE-2021-47515

CVE.ORG link : CVE-2021-47515

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference