CVE-2021-47162— tipc: skb_linearize the head skb when reassembling msgs
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于tipc中存在释放后重用。
Possible ATT&CK Techniques 1 AI
T1211 · Exploitation for StealthAffected Version Matrix 22
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 45c8b7b175ceb2d542e0fe15247377bf3bce29ec< b2c8d28c34b3070407cb1741f9ba3f15d0284b8b |
affected |
45c8b7b175ceb2d542e0fe15247377bf3bce29ec< 5489f30bb78ff0dafb4229a69632afc2ba20765c |
affected | ||
45c8b7b175ceb2d542e0fe15247377bf3bce29ec< 436d650d374329a591c30339a91fa5078052ed1e |
affected | ||
45c8b7b175ceb2d542e0fe15247377bf3bce29ec< 4b1761898861117c97066aea6c58f68a7787f0bf |
affected | ||
45c8b7b175ceb2d542e0fe15247377bf3bce29ec< 64d17ec9f1ded042c4b188d15734f33486ed9966 |
affected | ||
45c8b7b175ceb2d542e0fe15247377bf3bce29ec< 6da24cfc83ba4f97ea44fc7ae9999a006101755c |
affected | ||
45c8b7b175ceb2d542e0fe15247377bf3bce29ec< ace300eecbccaa698e2b472843c74a5f33f7dce8 |
affected | ||
45c8b7b175ceb2d542e0fe15247377bf3bce29ec< b7df21cf1b79ab7026f545e7bf837bd5750ac026 |
affected | ||
| … +14 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-47162
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
tipc: skb_linearize the head skb when reassembling msgs
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
tipc: skb_linearize the head skb when reassembling msgs
It's not a good idea to append the frag skb to a skb's frag_list if
the frag_list already has skbs from elsewhere, such as this skb was
created by pskb_copy() where the frag_list was cloned (all the skbs
in it were skb_get'ed) and shared by multiple skbs.
However, the new appended frag skb should have been only seen by the
current skb. Otherwise, it will cause use after free crashes as this
appended frag skb are seen by multiple skbs but it only got skb_get
called once.
The same thing happens with a skb updated by pskb_may_pull() with a
skb_cloned skb. Li Shuang has reported quite a few crashes caused
by this when doing testing over macvlan devices:
[] kernel BUG at net/core/skbuff.c:1970!
[] Call Trace:
[] skb_clone+0x4d/0xb0
[] macvlan_broadcast+0xd8/0x160 [macvlan]
[] macvlan_process_broadcast+0x148/0x150 [macvlan]
[] process_one_work+0x1a7/0x360
[] worker_thread+0x30/0x390
[] kernel BUG at mm/usercopy.c:102!
[] Call Trace:
[] __check_heap_object+0xd3/0x100
[] __check_object_size+0xff/0x16b
[] simple_copy_to_iter+0x1c/0x30
[] __skb_datagram_iter+0x7d/0x310
[] __skb_datagram_iter+0x2a5/0x310
[] skb_copy_datagram_iter+0x3b/0x90
[] tipc_recvmsg+0x14a/0x3a0 [tipc]
[] ____sys_recvmsg+0x91/0x150
[] ___sys_recvmsg+0x7b/0xc0
[] kernel BUG at mm/slub.c:305!
[] Call Trace:
[] <IRQ>
[] kmem_cache_free+0x3ff/0x400
[] __netif_receive_skb_core+0x12c/0xc40
[] ? kmem_cache_alloc+0x12e/0x270
[] netif_receive_skb_internal+0x3d/0xb0
[] ? get_rx_page_info+0x8e/0xa0 [be2net]
[] be_poll+0x6ef/0xd00 [be2net]
[] ? irq_exit+0x4f/0x100
[] net_rx_action+0x149/0x3b0
...
This patch is to fix it by linearizing the head skb if it has frag_list
set in tipc_buf_append(). Note that we choose to do this before calling
skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can
not just drop the frag_list either as the early time.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于tipc中存在释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-47162
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47162
请登录查看更多情报信息。
Other References for CVE-2021-47162 (6)
Same Patch Batch · Linux · 2024-03-25 · 40 CVEs total
| CVE-2021-47137 | 9.8 CRITICAL | net: lantiq: fix memory corruption in RX ring |
| CVE-2021-47168 | 9.8 CRITICAL | NFS: fix an incorrect limit in filelayout_decode_layout() |
| CVE-2021-47136 | 8.6 HIGH | net: zero-initialize tc skb extension on allocation |
| CVE-2021-47160 | 8.1 HIGH | net: dsa: mt7530: fix VLAN traffic leaks |
| CVE-2021-47142 | 7.8 HIGH | drm/amdgpu: Fix a use-after-free |
| CVE-2021-47148 | 7.8 HIGH | octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context() |
| CVE-2021-47175 | 7.8 HIGH | net/sched: fq_pie: fix OOB access in the traffic path |
| CVE-2021-47163 | 7.8 HIGH | tipc: wait and exit until all work queues are done |
| CVE-2021-47152 | 7.8 HIGH | mptcp: fix data stream corruption |
| CVE-2021-47153 | 7.8 HIGH | i2c: i801: Don't generate an interrupt on bus reset |
| CVE-2021-47158 | 7.8 HIGH | net: dsa: sja1105: add error handling in sja1105_setup() |
| CVE-2021-47159 | 7.8 HIGH | net: dsa: fix a crash if ->get_sset_count() fails |
| CVE-2021-47179 | 7.5 HIGH | NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() |
| CVE-2021-47178 | 7.5 HIGH | scsi: target: core: Avoid smp_processor_id() in preemptible code |
| CVE-2021-47173 | misc/uss720: fix memory leak in uss720_probe | |
| CVE-2021-47138 | cxgb4: avoid accessing registers when clearing filters | |
| CVE-2021-47169 | serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait' | |
| CVE-2021-47170 | USB: usbfs: Don't WARN about excessively large memory allocations | |
| CVE-2021-47171 | net: usb: fix memory leak in smsc75xx_bind | |
| CVE-2021-47172 | iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers |
Showing top 20 of 40 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2021-47162
No comments yet