Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-47588— sit: do not call ipip6_dev_free() from sit_init_net()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ipip6_dev_free()函数被错误地从sit_init_net()调用。

CVSS 7.8 · High EPSS 0.26% · P17

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux cf124db566e6b036b8bcbe8decbed740bdfac8c6< 4e1797914d8f223726ff6ae5ece4f97d73f21bab affected
cf124db566e6b036b8bcbe8decbed740bdfac8c6< e56b65c1e74d7f706d74b51baba15187be2fb4b5 affected
cf124db566e6b036b8bcbe8decbed740bdfac8c6< ad0ed314d6167b212939e3839428ba0c8bb16adb affected
cf124db566e6b036b8bcbe8decbed740bdfac8c6< 6f46c59e60b64620d5d386c8ee2eaa11ebe3b595 affected
cf124db566e6b036b8bcbe8decbed740bdfac8c6< 44a6c846bc3a7efe7d394bab8b2ae3b7f580e190 affected
cf124db566e6b036b8bcbe8decbed740bdfac8c6< e28587cc491ef0f3c51258fdc87fbc386b1d4c59 affected
95876855a55072572895a236b156ffb357fd5538 affected
4.11.9< 4.12 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-47588

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
sit: do not call ipip6_dev_free() from sit_init_net()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6_dev_free() from sit_init_net() ipip6_dev_free is sit dev->priv_destructor, already called by register_netdevice() if something goes wrong. Alternative would be to make ipip6_dev_free() robust against multiple invocations, but other drivers do not implement this strategy. syzbot reported: dst_release underflow WARNING: CPU: 0 PID: 5059 at net/core/dst.c:173 dst_release+0xd8/0xe0 net/core/dst.c:173 Modules linked in: CPU: 1 PID: 5059 Comm: syz-executor.4 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:dst_release+0xd8/0xe0 net/core/dst.c:173 Code: 4c 89 f2 89 d9 31 c0 5b 41 5e 5d e9 da d5 44 f9 e8 1d 90 5f f9 c6 05 87 48 c6 05 01 48 c7 c7 80 44 99 8b 31 c0 e8 e8 67 29 f9 <0f> 0b eb 85 0f 1f 40 00 53 48 89 fb e8 f7 8f 5f f9 48 83 c3 a8 48 RSP: 0018:ffffc9000aa5faa0 EFLAGS: 00010246 RAX: d6894a925dd15a00 RBX: 00000000ffffffff RCX: 0000000000040000 RDX: ffffc90005e19000 RSI: 000000000003ffff RDI: 0000000000040000 RBP: 0000000000000000 R08: ffffffff816a1f42 R09: ffffed1017344f2c R10: ffffed1017344f2c R11: 0000000000000000 R12: 0000607f462b1358 R13: 1ffffffff1bfd305 R14: ffffe8ffffcb1358 R15: dffffc0000000000 FS: 00007f66c71a2700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88aaed5058 CR3: 0000000023e0f000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> dst_cache_destroy+0x107/0x1e0 net/core/dst_cache.c:160 ipip6_dev_free net/ipv6/sit.c:1414 [inline] sit_init_net+0x229/0x550 net/ipv6/sit.c:1936 ops_init+0x313/0x430 net/core/net_namespace.c:140 setup_net+0x35b/0x9d0 net/core/net_namespace.c:326 copy_net_ns+0x359/0x5c0 net/core/net_namespace.c:470 create_new_namespaces+0x4ce/0xa00 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x11e/0x180 kernel/nsproxy.c:226 ksys_unshare+0x57d/0xb50 kernel/fork.c:3075 __do_sys_unshare kernel/fork.c:3146 [inline] __se_sys_unshare kernel/fork.c:3144 [inline] __x64_sys_unshare+0x34/0x40 kernel/fork.c:3144 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f66c882ce99 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f66c71a2168 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007f66c893ff60 RCX: 00007f66c882ce99 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000048040200 RBP: 00007f66c8886ff1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff6634832f R14: 00007f66c71a2300 R15: 0000000000022000 </TASK>
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ipip6_dev_free()函数被错误地从sit_init_net()调用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux cf124db566e6b036b8bcbe8decbed740bdfac8c6 ~ 4e1797914d8f223726ff6ae5ece4f97d73f21bab -
Linux Linux 4.12 -

II. Public POCs for CVE-2021-47588

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-47588

请登录查看更多情报信息。

Other References for CVE-2021-47588 (6)

Same Patch Batch · Linux · 2024-06-19 · 122 CVEs total

CVE-2024-38558 10.0 CRITICAL net: openvswitch: fix overwriting ct original tuple for ICMPv6
CVE-2024-38570 9.8 CRITICAL gfs2: Fix potential glock use-after-free on unmount
CVE-2021-47587 9.8 CRITICAL net: systemport: Add global locking for descriptor lifecycle
CVE-2024-38544 9.8 CRITICAL RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
CVE-2021-47611 8.1 HIGH mac80211: validate extended element ID is present
CVE-2024-38587 7.8 HIGH speakup: Fix sizeof() vs ARRAY_SIZE() bug
CVE-2024-38556 7.8 HIGH net/mlx5: Add a timeout to acquire the command queue semaphore
CVE-2024-38605 7.8 HIGH ALSA: core: Fix NULL module pointer assignment at card init
CVE-2024-38599 7.8 HIGH jffs2: prevent xattr node from overflowing the eraseblock
CVE-2024-38592 7.8 HIGH drm/mediatek: Init `ddp_comp` with devm_kcalloc()
CVE-2024-38588 7.8 HIGH ftrace: Fix possible use-after-free issue in ftrace_location()
CVE-2024-38564 7.8 HIGH bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
CVE-2024-38568 7.8 HIGH drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
CVE-2024-38572 7.8 HIGH wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
CVE-2024-38578 7.8 HIGH ecryptfs: Fix buffer size for tag 66 packet
CVE-2024-38569 7.8 HIGH drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
CVE-2024-38581 7.8 HIGH drm/amdgpu/mes: fix use-after-free issue
CVE-2024-38583 7.8 HIGH nilfs2: fix use-after-free of timer for log writer thread
CVE-2024-38614 7.8 HIGH openrisc: traps: Don't send signals to kernel mode threads
CVE-2024-38580 7.8 HIGH epoll: be better about file lifetimes

Showing top 20 of 122 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2021-47588

No comments yet

Leave a comment