Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47242— mptcp: fix soft lookup in subflow_error_report()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。

CVSS 7.5 · High EPSS 0.34% · P26

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 15cc10453398c22f78f6c2b897119ecce5e5dd89< 27ef25c72373222aaa5fe7b5cd890ae9cfb89a8d affected
15cc10453398c22f78f6c2b897119ecce5e5dd89< 499ada5073361c631f2a3c4a8aed44d53b6f82ec affected
c8ad65cb5051498b8a58be40499db9e930f0092e affected
5.11.12< 5.12 affected
5.12 affected
< 5.12 unaffected
5.12.13≤ 5.12.* unaffected
5.13≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47242

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mptcp: fix soft lookup in subflow_error_report()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix soft lookup in subflow_error_report() Maxim reported a soft lookup in subflow_error_report(): watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [swapper/0:0] RIP: 0010:native_queued_spin_lock_slowpath RSP: 0018:ffffa859c0003bc0 EFLAGS: 00000202 RAX: 0000000000000101 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff9195c2772d88 RSI: 0000000000000000 RDI: ffff9195c2772d88 RBP: ffff9195c2772d00 R08: 00000000000067b0 R09: c6e31da9eb1e44f4 R10: ffff9195ef379700 R11: ffff9195edb50710 R12: ffff9195c2772d88 R13: ffff9195f500e3d0 R14: ffff9195ef379700 R15: ffff9195ef379700 FS: 0000000000000000(0000) GS:ffff91961f400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c000407000 CR3: 0000000002988000 CR4: 00000000000006f0 Call Trace: <IRQ> _raw_spin_lock_bh subflow_error_report mptcp_subflow_data_available __mptcp_move_skbs_from_subflow mptcp_data_ready tcp_data_queue tcp_rcv_established tcp_v4_do_rcv tcp_v4_rcv ip_protocol_deliver_rcu ip_local_deliver_finish __netif_receive_skb_one_core netif_receive_skb rtl8139_poll 8139too __napi_poll net_rx_action __do_softirq __irq_exit_rcu common_interrupt </IRQ> The calling function - mptcp_subflow_data_available() - can be invoked from different contexts: - plain ssk socket lock - ssk socket lock + mptcp_data_lock - ssk socket lock + mptcp_data_lock + msk socket lock. Since subflow_error_report() tries to acquire the mptcp_data_lock, the latter two call chains will cause soft lookup. This change addresses the issue moving the error reporting call to outer functions, where the held locks list is known and the we can acquire only the needed one.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 15cc10453398c22f78f6c2b897119ecce5e5dd89 ~ 27ef25c72373222aaa5fe7b5cd890ae9cfb89a8d -
Linux Linux 5.12 -

II. Public POCs for CVE-2021-47242

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47242

请登录查看更多情报信息。

Other References for CVE-2021-47242 (2)

Same Patch Batch · Linux · 2024-05-21 · 361 CVEs total

CVE-2023-52741 9.8 CRITICAL cifs: Fix use-after-free in rdata->read_into_pages()
CVE-2023-52755 9.8 CRITICAL ksmbd: fix slab out of bounds write in smb_inherit_dacl()
CVE-2021-47427 9.8 CRITICAL scsi: iscsi: Fix iscsi_task use after free
CVE-2023-52732 9.8 CRITICAL ceph: blocklist the kclient when receiving corrupted snap trace
CVE-2021-47378 9.8 CRITICAL nvme-rdma: destroy cm id before destroy qp to avoid use after free
CVE-2021-47232 9.8 CRITICAL can: j1939: fix Use-after-Free, hold skb ref while in use
CVE-2021-47328 9.8 CRITICAL scsi: iscsi: Fix conn use after free during resets
CVE-2023-52769 8.8 HIGH wifi: ath12k: fix htt mlo-offset event locking
CVE-2023-52790 8.8 HIGH swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC
CVE-2021-47308 8.8 HIGH scsi: libfc: Fix array index out of bound exception
CVE-2021-47390 8.8 HIGH KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()
CVE-2021-47388 8.8 HIGH mac80211: fix use-after-free in CCMP/GCMP RX
CVE-2023-52776 8.8 HIGH wifi: ath12k: fix dfs-radar and temperature event locking
CVE-2023-52798 8.8 HIGH wifi: ath11k: fix dfs radar event locking
CVE-2023-52801 8.8 HIGH iommufd: Fix missing update of domains_itree after splitting iopt_area
CVE-2023-52846 8.8 HIGH hsr: Prevent use after free in prp_create_tagged_frame()
CVE-2021-47352 8.4 HIGH virtio-net: Add validation for used length
CVE-2021-47240 8.4 HIGH net: qrtr: fix OOB Read in qrtr_endpoint_post
CVE-2023-52829 8.4 HIGH wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps()
CVE-2021-47244 8.2 HIGH mptcp: Fix out of bounds when parsing TCP options

Showing top 20 of 361 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47242

No comments yet

Leave a comment