Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47515— seg6: fix the iif in the IPv6 socket control block

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 seg6 模块 IPv6 套接字控制块中的 iif。

CVSS 7.5 · High EPSS 0.75% · P54

Possible ATT&CK Techniques 1 AI

T1564 · Hide Artifacts

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux c630ec8bdadae9d557b1ceb9d6c06e149108a0d4< b16d412e5f79734033df04e97d7ea2f50a8e9fe3 affected
2f704348c93ff8119e642dae6a72327f90b82810< 6431e71093f3da586a00c6d931481ffb0dc2db0e affected
ef489749aae508e6f17886775c075f12ff919fb1< ef8804e47c0a44ae106ead1740408af5ea6c6ee9 affected
ef489749aae508e6f17886775c075f12ff919fb1< 666521b3852d2b2f52d570f9122b1e4b50d96831 affected
ef489749aae508e6f17886775c075f12ff919fb1< 98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1 affected
ef489749aae508e6f17886775c075f12ff919fb1< ae68d93354e5bf5191ee673982251864ea24dd5c affected
b71b7e0280f47b4ac633fbfd153423814ea87810 affected
4.14.98< 4.14.258 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47515

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
seg6: fix the iif in the IPv6 socket control block
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: seg6: fix the iif in the IPv6 socket control block When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving interface index into the IPv4 socket control block (v5.16-rc4, net/ipv4/ip_input.c line 510): IPCB(skb)->iif = skb->skb_iif; If that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH header, the seg6_do_srh_encap(...) performs the required encapsulation. In this case, the seg6_do_srh_encap function clears the IPv6 socket control block (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163): memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); The memset(...) was introduced in commit ef489749aae5 ("ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation") a long time ago (2019-01-29). Since the IPv6 socket control block and the IPv4 socket control block share the same memory area (skb->cb), the receiving interface index info is lost (IP6CB(skb)->iif is set to zero). As a side effect, that condition triggers a NULL pointer dereference if commit 0857d6f8c759 ("ipv6: When forwarding count rx stats on the orig netdev") is applied. To fix that issue, we set the IP6CB(skb)->iif with the index of the receiving interface once again.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 seg6 模块 IPv6 套接字控制块中的 iif。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c630ec8bdadae9d557b1ceb9d6c06e149108a0d4 ~ b16d412e5f79734033df04e97d7ea2f50a8e9fe3 -
Linux Linux 5.0 -

II. Public POCs for CVE-2021-47515

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47515

请登录查看更多情报信息。

Other References for CVE-2021-47515 (5)

Same Patch Batch · Linux · 2024-05-24 · 72 CVEs total

CVE-2021-47544 9.8 CRITICAL tcp: fix page frag corruption on page fault
CVE-2021-47536 9.8 CRITICAL net/smc: fix wrong list_del in smc_lgr_cleanup_early
CVE-2021-47506 9.8 CRITICAL nfsd: fix use-after-free due to delegation race
CVE-2021-47520 8.8 HIGH can: pch_can: pch_can_rx_normal: fix use after free
CVE-2021-47535 7.8 HIGH drm/msm/a6xx: Allocate enough space for GMU registers
CVE-2021-47533 7.8 HIGH drm/vc4: kms: Clear the HVS FIFO commit pointer once done
CVE-2021-47552 7.8 HIGH blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()
CVE-2021-47500 7.8 HIGH iio: mma8452: Fix trigger reference couting
CVE-2021-47551 7.8 HIGH drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
CVE-2021-47555 7.8 HIGH net: vlan: fix underflow for the real_dev refcnt
CVE-2021-47541 7.8 HIGH net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
CVE-2021-47561 7.8 HIGH i2c: virtio: disable timeout handling
CVE-2021-47517 7.8 HIGH ethtool: do not perform operations on net devices being unregistered
CVE-2021-47505 7.8 HIGH aio: fix use-after-free due to missing POLLFREE handling
CVE-2021-47512 7.8 HIGH net/sched: fq_pie: prevent dismantle issue
CVE-2021-47502 7.8 HIGH ASoC: codecs: wcd934x: handle channel mappping list correctly
CVE-2023-52880 7.8 HIGH tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
CVE-2021-47559 7.5 HIGH net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
CVE-2021-47549 sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
CVE-2021-47548 ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst

Showing top 20 of 72 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47515

No comments yet

Leave a comment