CVE-2021-47544— tcp: fix page frag corruption on page fault
Possible ATT&CK Techniques 2AI
T1068 · Exploitation for Privilege Escalation T1211 · Exploitation for StealthAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 5640f7685831e088fe6c2e1f863a6805962f8e81< c6f340a331fb72e5ac23a083de9c780e132ca3ae | affected |
5640f7685831e088fe6c2e1f863a6805962f8e81< 5a9afcd827cafe14a95c9fcbded2c2d104f18dfc | affected | ||
5640f7685831e088fe6c2e1f863a6805962f8e81< dacb5d8875cc6cd3a553363b4d6f06760fcbe70c | affected | ||
3.7 | affected | ||
< 3.7 | unaffected | ||
5.10.84≤ 5.10.* | unaffected | ||
5.15.7≤ 5.15.* | unaffected | ||
5.16≤ * | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-47544
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
tcp: fix page frag corruption on page fault
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix page frag corruption on page fault Steffen reported a TCP stream corruption for HTTP requests served by the apache web-server using a cifs mount-point and memory mapping the relevant file. The root cause is quite similar to the one addressed by commit 20eb4f29b602 ("net: fix sk_page_frag() recursion from memory reclaim"). Here the nested access to the task page frag is caused by a page fault on the (mmapped) user-space memory buffer coming from the cifs file. The page fault handler performs an smb transaction on a different socket, inside the same process context. Since sk->sk_allaction for such socket does not prevent the usage for the task_frag, the nested allocation modify "under the hood" the page frag in use by the outer sendmsg call, corrupting the stream. The overall relevant stack trace looks like the following: httpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked: ffffffff91461d91 tcp_sendmsg_locked+0x1 ffffffff91462b57 tcp_sendmsg+0x27 ffffffff9139814e sock_sendmsg+0x3e ffffffffc06dfe1d smb_send_kvec+0x28 [...] ffffffffc06cfaf8 cifs_readpages+0x213 ffffffff90e83c4b read_pages+0x6b ffffffff90e83f31 __do_page_cache_readahead+0x1c1 ffffffff90e79e98 filemap_fault+0x788 ffffffff90eb0458 __do_fault+0x38 ffffffff90eb5280 do_fault+0x1a0 ffffffff90eb7c84 __handle_mm_fault+0x4d4 ffffffff90eb8093 handle_mm_fault+0xc3 ffffffff90c74f6d __do_page_fault+0x1ed ffffffff90c75277 do_page_fault+0x37 ffffffff9160111e page_fault+0x1e ffffffff9109e7b5 copyin+0x25 ffffffff9109eb40 _copy_from_iter_full+0xe0 ffffffff91462370 tcp_sendmsg_locked+0x5e0 ffffffff91462370 tcp_sendmsg_locked+0x5e0 ffffffff91462b57 tcp_sendmsg+0x27 ffffffff9139815c sock_sendmsg+0x4c ffffffff913981f7 sock_write_iter+0x97 ffffffff90f2cc56 do_iter_readv_writev+0x156 ffffffff90f2dff0 do_iter_write+0x80 ffffffff90f2e1c3 vfs_writev+0xa3 ffffffff90f2e27c do_writev+0x5c ffffffff90c042bb do_syscall_64+0x5b ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65 The cifs filesystem rightfully sets sk_allocations to GFP_NOFS, we can avoid the nesting using the sk page frag for allocation lacking the __GFP_FS flag. Do not define an additional mm-helper for that, as this is strictly tied to the sk page frag usage. v1 -> v2: - use a stricted sk_page_frag() check instead of reordering the code (Eric)
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 tcp 模块页面错误导致的页面碎片损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-47544
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47544
请登录查看更多情报信息。
Other References for CVE-2021-47544 (3)
Same Patch Batch · Linux · 2024-05-24 · 72 CVEs total
| CVE-2021-47506 | 9.8 CRITICAL | nfsd: fix use-after-free due to delegation race |
| CVE-2021-47536 | 9.8 CRITICAL | net/smc: fix wrong list_del in smc_lgr_cleanup_early |
| CVE-2021-47520 | 8.8 HIGH | can: pch_can: pch_can_rx_normal: fix use after free |
| CVE-2023-52880 | 7.8 HIGH | tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc |
| CVE-2021-47512 | 7.8 HIGH | net/sched: fq_pie: prevent dismantle issue |
| CVE-2021-47505 | 7.8 HIGH | aio: fix use-after-free due to missing POLLFREE handling |
| CVE-2021-47502 | 7.8 HIGH | ASoC: codecs: wcd934x: handle channel mappping list correctly |
| CVE-2021-47517 | 7.8 HIGH | ethtool: do not perform operations on net devices being unregistered |
| CVE-2021-47533 | 7.8 HIGH | drm/vc4: kms: Clear the HVS FIFO commit pointer once done |
| CVE-2021-47500 | 7.8 HIGH | iio: mma8452: Fix trigger reference couting |
| CVE-2021-47541 | 7.8 HIGH | net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() |
| CVE-2021-47552 | 7.8 HIGH | blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release() |
| CVE-2021-47551 | 7.8 HIGH | drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again |
| CVE-2021-47555 | 7.8 HIGH | net: vlan: fix underflow for the real_dev refcnt |
| CVE-2021-47561 | 7.8 HIGH | i2c: virtio: disable timeout handling |
| CVE-2021-47535 | 7.8 HIGH | drm/msm/a6xx: Allocate enough space for GMU registers |
| CVE-2021-47515 | 7.5 HIGH | seg6: fix the iif in the IPv6 socket control block |
| CVE-2021-47559 | 7.5 HIGH | net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() |
| CVE-2021-47558 | net: stmmac: Disable Tx queues when reconfiguring the interface | |
| CVE-2021-47556 | ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() |
Showing top 20 of 72 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74583
net/sched: cls_route: fix fastmap use-after-free on filter - CVE-2026-74581
net: ipv6: clear suppressed fib6 rule result - CVE-2026-74582
packet: use consistent hard_header_len in non-ring send path - CVE-2026-74580
vhost: reset the vring metadata cache on vring reconfigurati - CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off
Same vendor: Linux
- CVE-2026-74583
net/sched: cls_route: fix fastmap use-after-free on filter - CVE-2026-74581
net: ipv6: clear suppressed fib6 rule result - CVE-2026-74582
packet: use consistent hard_header_len in non-ring send path - CVE-2026-74580
vhost: reset the vring metadata cache on vring reconfigurati - CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off
V. Comments for CVE-2021-47544
No comments yet