Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2021-47451— netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value

CVSS 7.8 · High EPSS 0.23% · P14

Affected Version Matrix 8

VendorProductVersion RangeStatus
LinuxLinux68983a354a655c35d3fb204489d383a2a051fda7< 2a670c323055282c9b72794a491d53cef86bbeafaffected
68983a354a655c35d3fb204489d383a2a051fda7< cae7cab804c943d723d52724a3aeb07a3f4a2650affected
68983a354a655c35d3fb204489d383a2a051fda7< 902c0b1887522a099aa4e1e6b4b476c2fe5dd13eaffected
5.7affected
< 5.7unaffected
5.10.76≤ 5.10.*unaffected
5.14.15≤ 5.14.*unaffected
5.15≤ *unaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2021-47451

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value Currently, when the rule related to IDLETIMER is added, idletimer_tg timer structure is initialized by kmalloc on executing idletimer_tg_create function. However, in this process timer->timer_type is not defined to a specific value. Thus, timer->timer_type has garbage value and it occurs kernel panic. So, this commit fixes the panic by initializing timer->timer_type using kzalloc instead of kmalloc. Test commands: # iptables -A OUTPUT -j IDLETIMER --timeout 1 --label test $ cat /sys/class/xt_idletimer/timers/test Killed Splat looks like: BUG: KASAN: user-memory-access in alarm_expires_remaining+0x49/0x70 Read of size 8 at addr 0000002e8c7bc4c8 by task cat/917 CPU: 12 PID: 917 Comm: cat Not tainted 5.14.0+ #3 79940a339f71eb14fc81aee1757a20d5bf13eb0e Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack_lvl+0x6e/0x9c kasan_report.cold+0x112/0x117 ? alarm_expires_remaining+0x49/0x70 __asan_load8+0x86/0xb0 alarm_expires_remaining+0x49/0x70 idletimer_tg_show+0xe5/0x19b [xt_IDLETIMER 11219304af9316a21bee5ba9d58f76a6b9bccc6d] dev_attr_show+0x3c/0x60 sysfs_kf_seq_show+0x11d/0x1f0 ? device_remove_bin_file+0x20/0x20 kernfs_seq_show+0xa4/0xb0 seq_read_iter+0x29c/0x750 kernfs_fop_read_iter+0x25a/0x2c0 ? __fsnotify_parent+0x3d1/0x570 ? iov_iter_init+0x70/0x90 new_sync_read+0x2a7/0x3d0 ? __x64_sys_llseek+0x230/0x230 ? rw_verify_area+0x81/0x150 vfs_read+0x17b/0x240 ksys_read+0xd9/0x180 ? vfs_write+0x460/0x460 ? do_syscall_64+0x16/0xc0 ? lockdep_hardirqs_on+0x79/0x120 __x64_sys_read+0x43/0x50 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f0cdc819142 Code: c0 e9 c2 fe ff ff 50 48 8d 3d 3a ca 0a 00 e8 f5 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 RSP: 002b:00007fff28eee5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f0cdc819142 RDX: 0000000000020000 RSI: 00007f0cdc032000 RDI: 0000000000000003 RBP: 00007f0cdc032000 R08: 00007f0cdc031010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 00005607e9ee31f0 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于当timer_type具有垃圾值时会发生恐慌。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 68983a354a655c35d3fb204489d383a2a051fda7 ~ 2a670c323055282c9b72794a491d53cef86bbeaf -
LinuxLinux 5.7 -

II. Public POCs for CVE-2021-47451

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47451

请登录查看更多情报信息。

Other References for CVE-2021-47451 (3)

Same Patch Batch · Linux · 2024-05-22 · 63 CVEs total

CVE-2021-474969.8 CRITICALnet/tls: Fix flipped sign in tls_err_abort() calls
CVE-2021-474789.1 CRITICALisofs: Fix out of bound access for corrupted isofs image
CVE-2021-474508.8 HIGHKVM: arm64: Fix host stage-2 PGD refcount
CVE-2021-474338.1 HIGHbtrfs: fix abort logic in btrfs_replace_file_extents
CVE-2021-474857.8 HIGHIB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
CVE-2021-474467.8 HIGHdrm/msm/a4xx: fix error handling in a4xx_gpu_init()
CVE-2021-474477.8 HIGHdrm/msm/a3xx: fix error handling in a3xx_gpu_init()
CVE-2021-474927.8 HIGHmm, thp: bail out early in collapse_file for writeback page
CVE-2021-474937.8 HIGHocfs2: fix race between searching chunks and release journal_head from buffer_head
CVE-2021-474947.8 HIGHcfg80211: fix management registrations locking
CVE-2021-474837.8 HIGHregmap: Fix possible double-free in regcache_rbtree_exit()
CVE-2021-474617.8 HIGHuserfaultfd: fix a race between writeprotect and exit_mmap()
CVE-2021-474597.8 HIGHcan: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
CVE-2021-474487.5 HIGHmptcp: fix possible stall on recvmsg()
CVE-2021-474587.1 HIGHocfs2: mount fails with buffer overflow in strlen
CVE-2021-474657.1 HIGHKVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
CVE-2021-474387.1 HIGHnet/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path
CVE-2024-36010igb: Fix string truncation warnings in igb_set_fw_version
CVE-2021-47473scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()
CVE-2021-47474comedi: vmk80xx: fix bulk-buffer overflow

Showing top 20 of 63 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47451

No comments yet

Leave a comment