Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47131— net/tls: Fix use-after-free after the TLS device goes down and up

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 net 模块的 TLS 设备关闭和启动后的释放后重用问题。

CVSS 8.1 · High EPSS 0.75% · P54

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux e8f69799810c32dd40c6724d829eccc70baad07f< f1d4184f128dede82a59a841658ed40d4e6d3aa2 affected
e8f69799810c32dd40c6724d829eccc70baad07f< 0f1e6fe66977a864fe850522316f713d7b926fd9 affected
e8f69799810c32dd40c6724d829eccc70baad07f< c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4 affected
4.18 affected
< 4.18 unaffected
5.10.43≤ 5.10.* unaffected
5.12.10≤ 5.12.* unaffected
5.13≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47131

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net/tls: Fix use-after-free after the TLS device goes down and up
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix use-after-free after the TLS device goes down and up When a netdev with active TLS offload goes down, tls_device_down is called to stop the offload and tear down the TLS context. However, the socket stays alive, and it still points to the TLS context, which is now deallocated. If a netdev goes up, while the connection is still active, and the data flow resumes after a number of TCP retransmissions, it will lead to a use-after-free of the TLS context. This commit addresses this bug by keeping the context alive until its normal destruction, and implements the necessary fallbacks, so that the connection can resume in software (non-offloaded) kTLS mode. On the TX side tls_sw_fallback is used to encrypt all packets. The RX side already has all the necessary fallbacks, because receiving non-decrypted packets is supported. The thing needed on the RX side is to block resync requests, which are normally produced after receiving non-decrypted packets. The necessary synchronization is implemented for a graceful teardown: first the fallbacks are deployed, then the driver resources are released (it used to be possible to have a tls_dev_resync after tls_dev_del). A new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback mode. It's used to skip the RX resync logic completely, as it becomes useless, and some objects may be released (for example, resync_async, which is allocated and freed by the driver).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 net 模块的 TLS 设备关闭和启动后的释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux e8f69799810c32dd40c6724d829eccc70baad07f ~ f1d4184f128dede82a59a841658ed40d4e6d3aa2 -
Linux Linux 4.18 -

II. Public POCs for CVE-2021-47131

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47131

请登录查看更多情报信息。

Other References for CVE-2021-47131 (3)

Same Patch Batch · Linux · 2024-03-15 · 26 CVEs total

CVE-2021-47111 8.8 HIGH xen-netback: take a reference to the RX task thread
CVE-2021-47135 7.8 HIGH mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report
CVE-2021-47112 7.8 HIGH x86/kvm: Teardown PV features on boot CPU as well
CVE-2021-47129 7.8 HIGH netfilter: nft_ct: skip expectations for confirmed conntrack
CVE-2021-47123 7.8 HIGH io_uring: fix ltout double free on completion race
CVE-2021-47124 7.8 HIGH io_uring: fix link timeout refs
CVE-2021-47126 7.8 HIGH ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions
CVE-2021-47132 7.5 HIGH mptcp: fix sk_forward_memory corruption on retransmission
CVE-2021-47130 7.5 HIGH nvmet: fix freeing unallocated p2pmem
CVE-2021-47109 7.5 HIGH neighbour: allow NUD_NOARP entries to be forced GCed
CVE-2021-47113 7.1 HIGH btrfs: abort in rename_exchange if we fail to insert the second ref
CVE-2021-47122 net: caif: fix memory leak in caif_device_notify
CVE-2021-47134 efi/fdt: fix panic when no valid fdt found
CVE-2021-47133 HID: amd_sfh: Fix memory leak in amd_sfh_work
CVE-2021-47128 bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks
CVE-2021-47127 ice: track AF_XDP ZC enabled queues in bitmap
CVE-2021-47125 sch_htb: fix refcount leak in htb_parent_to_leaf_offload
CVE-2021-47121 net: caif: fix memory leak in cfusbl_device_notify
CVE-2021-47120 HID: magicmouse: fix NULL-deref on disconnect
CVE-2021-47119 ext4: fix memory leak in ext4_fill_super

Showing top 20 of 26 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47131

No comments yet

Leave a comment