CVE-2021-47399— ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ixgbe模块ixgbe_xdp_setup中存在空指针取消引用。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 4a9b32f30f805ca596d76605903a48eab58e0b88< 20f6c4a31a525edd9ea6243712b868ba0e4e331e |
affected |
4a9b32f30f805ca596d76605903a48eab58e0b88< 2744341dd52e935344ca1b4bf189ba0d182a3e8e |
affected | ||
4a9b32f30f805ca596d76605903a48eab58e0b88< 513e605d7a9ce136886cb42ebb2c40e9a6eb6333 |
affected | ||
5.0 |
affected | ||
< 5.0 |
unaffected | ||
5.10.71≤ 5.10.* |
unaffected | ||
5.14.10≤ 5.14.* |
unaffected | ||
5.15≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-47399
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
The ixgbe driver currently generates a NULL pointer dereference with
some machine (online cpus < 63). This is due to the fact that the
maximum value of num_xdp_queues is nr_cpu_ids. Code is in
"ixgbe_set_rss_queues"".
Here's how the problem repeats itself:
Some machine (online cpus < 63), And user set num_queues to 63 through
ethtool. Code is in the "ixgbe_set_channels",
adapter->ring_feature[RING_F_FDIR].limit = count;
It becomes 63.
When user use xdp, "ixgbe_set_rss_queues" will set queues num.
adapter->num_rx_queues = rss_i;
adapter->num_tx_queues = rss_i;
adapter->num_xdp_queues = ixgbe_xdp_queues(adapter);
And rss_i's value is from
f = &adapter->ring_feature[RING_F_FDIR];
rss_i = f->indices = f->limit;
So "num_rx_queues" > "num_xdp_queues", when run to "ixgbe_xdp_setup",
for (i = 0; i < adapter->num_rx_queues; i++)
if (adapter->xdp_ring[i]->xsk_umem)
It leads to panic.
Call trace:
[exception RIP: ixgbe_xdp+368]
RIP: ffffffffc02a76a0 RSP: ffff9fe16202f8d0 RFLAGS: 00010297
RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000000000001c RDI: ffffffffa94ead90
RBP: ffff92f8f24c0c18 R8: 0000000000000000 R9: 0000000000000000
R10: ffff9fe16202f830 R11: 0000000000000000 R12: ffff92f8f24c0000
R13: ffff9fe16202fc01 R14: 000000000000000a R15: ffffffffc02a7530
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
7 [ffff9fe16202f8f0] dev_xdp_install at ffffffffa89fbbcc
8 [ffff9fe16202f920] dev_change_xdp_fd at ffffffffa8a08808
9 [ffff9fe16202f960] do_setlink at ffffffffa8a20235
10 [ffff9fe16202fa88] rtnl_setlink at ffffffffa8a20384
11 [ffff9fe16202fc78] rtnetlink_rcv_msg at ffffffffa8a1a8dd
12 [ffff9fe16202fcf0] netlink_rcv_skb at ffffffffa8a717eb
13 [ffff9fe16202fd40] netlink_unicast at ffffffffa8a70f88
14 [ffff9fe16202fd80] netlink_sendmsg at ffffffffa8a71319
15 [ffff9fe16202fdf0] sock_sendmsg at ffffffffa89df290
16 [ffff9fe16202fe08] __sys_sendto at ffffffffa89e19c8
17 [ffff9fe16202ff30] __x64_sys_sendto at ffffffffa89e1a64
18 [ffff9fe16202ff38] do_syscall_64 at ffffffffa84042b9
19 [ffff9fe16202ff50] entry_SYSCALL_64_after_hwframe at ffffffffa8c0008c
So I fix ixgbe_max_channels so that it will not allow a setting of queues
to be higher than the num_online_cpus(). And when run to ixgbe_xdp_setup,
take the smaller value of num_rx_queues and num_xdp_queues.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ixgbe模块ixgbe_xdp_setup中存在空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-47399
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47399
请登录查看更多情报信息。
Other References for CVE-2021-47399 (3)
Same Patch Batch · Linux · 2024-05-21 · 361 CVEs total
| CVE-2023-52732 | 9.8 CRITICAL | ceph: blocklist the kclient when receiving corrupted snap trace |
| CVE-2023-52755 | 9.8 CRITICAL | ksmbd: fix slab out of bounds write in smb_inherit_dacl() |
| CVE-2021-47427 | 9.8 CRITICAL | scsi: iscsi: Fix iscsi_task use after free |
| CVE-2021-47378 | 9.8 CRITICAL | nvme-rdma: destroy cm id before destroy qp to avoid use after free |
| CVE-2023-52741 | 9.8 CRITICAL | cifs: Fix use-after-free in rdata->read_into_pages() |
| CVE-2021-47232 | 9.8 CRITICAL | can: j1939: fix Use-after-Free, hold skb ref while in use |
| CVE-2021-47328 | 9.8 CRITICAL | scsi: iscsi: Fix conn use after free during resets |
| CVE-2021-47308 | 8.8 HIGH | scsi: libfc: Fix array index out of bound exception |
| CVE-2023-52798 | 8.8 HIGH | wifi: ath11k: fix dfs radar event locking |
| CVE-2023-52776 | 8.8 HIGH | wifi: ath12k: fix dfs-radar and temperature event locking |
| CVE-2021-47390 | 8.8 HIGH | KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect() |
| CVE-2023-52790 | 8.8 HIGH | swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC |
| CVE-2023-52769 | 8.8 HIGH | wifi: ath12k: fix htt mlo-offset event locking |
| CVE-2023-52801 | 8.8 HIGH | iommufd: Fix missing update of domains_itree after splitting iopt_area |
| CVE-2021-47388 | 8.8 HIGH | mac80211: fix use-after-free in CCMP/GCMP RX |
| CVE-2023-52846 | 8.8 HIGH | hsr: Prevent use after free in prp_create_tagged_frame() |
| CVE-2021-47240 | 8.4 HIGH | net: qrtr: fix OOB Read in qrtr_endpoint_post |
| CVE-2021-47352 | 8.4 HIGH | virtio-net: Add validation for used length |
| CVE-2023-52829 | 8.4 HIGH | wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps() |
| CVE-2021-47245 | 8.2 HIGH | netfilter: synproxy: Fix out of bounds when parsing TCP options |
Showing top 20 of 361 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2021-47399
No comments yet