CVE-2021-47606— net: netlink: af_netlink: Prevent empty skb by adding a check on len.
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于af_netlink组件缺少对skb的长度检查。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1203 · Exploitation for Client Execution T1499 · Endpoint Denial of ServiceAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | bcbde0d449eda7afa8f63280b165c8300dbd00e2< c54a60c8fbaa774f828e26df79f66229a8a0e010 |
affected |
bcbde0d449eda7afa8f63280b165c8300dbd00e2< 40cf2e058832d9cfaae98dfd77334926275598b6 |
affected | ||
bcbde0d449eda7afa8f63280b165c8300dbd00e2< 54e785f7d5c197bc06dbb8053700df7e2a093ced |
affected | ||
bcbde0d449eda7afa8f63280b165c8300dbd00e2< ff3f517bf7138e01a17369042908a3f345c0ee41 |
affected | ||
bcbde0d449eda7afa8f63280b165c8300dbd00e2< c0315e93552e0d840e9edc6abd71c7db82ec8f51 |
affected | ||
bcbde0d449eda7afa8f63280b165c8300dbd00e2< dadce61247c6230489527cc5e343b6002d1114c5 |
affected | ||
bcbde0d449eda7afa8f63280b165c8300dbd00e2< 4c986072a8c9249b9398c7a18f216dc26a9f0e35 |
affected | ||
bcbde0d449eda7afa8f63280b165c8300dbd00e2< f123cffdd8fe8ea6c7fded4b88516a42798797d0 |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-47606
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net: netlink: af_netlink: Prevent empty skb by adding a check on len.
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net: netlink: af_netlink: Prevent empty skb by adding a check on len.
Adding a check on len parameter to avoid empty skb. This prevents a
division error in netem_enqueue function which is caused when skb->len=0
and skb->data_len=0 in the randomized corruption step as shown below.
skb->data[prandom_u32() % skb_headlen(skb)] ^= 1<<(prandom_u32() % 8);
Crash Report:
[ 343.170349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family
0 port 6081 - 0
[ 343.216110] netem: version 1.3
[ 343.235841] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
[ 343.236680] CPU: 3 PID: 4288 Comm: reproducer Not tainted 5.16.0-rc1+
[ 343.237569] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.11.0-2.el7 04/01/2014
[ 343.238707] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem]
[ 343.239499] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff
ff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f
74 <f7> f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03
[ 343.241883] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246
[ 343.242589] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX:
0000000000000000
[ 343.243542] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI:
ffff88800f8eda40
[ 343.244474] RBP: ffff88800bcd7458 R08: 0000000000000000 R09:
ffffffff94fb8445
[ 343.245403] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12:
0000000000000000
[ 343.246355] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15:
0000000000000020
[ 343.247291] FS: 00007fdde2bd7700(0000) GS:ffff888109780000(0000)
knlGS:0000000000000000
[ 343.248350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 343.249120] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4:
00000000000006e0
[ 343.250076] Call Trace:
[ 343.250423] <TASK>
[ 343.250713] ? memcpy+0x4d/0x60
[ 343.251162] ? netem_init+0xa0/0xa0 [sch_netem]
[ 343.251795] ? __sanitizer_cov_trace_pc+0x21/0x60
[ 343.252443] netem_enqueue+0xe28/0x33c0 [sch_netem]
[ 343.253102] ? stack_trace_save+0x87/0xb0
[ 343.253655] ? filter_irq_stacks+0xb0/0xb0
[ 343.254220] ? netem_init+0xa0/0xa0 [sch_netem]
[ 343.254837] ? __kasan_check_write+0x14/0x20
[ 343.255418] ? _raw_spin_lock+0x88/0xd6
[ 343.255953] dev_qdisc_enqueue+0x50/0x180
[ 343.256508] __dev_queue_xmit+0x1a7e/0x3090
[ 343.257083] ? netdev_core_pick_tx+0x300/0x300
[ 343.257690] ? check_kcov_mode+0x10/0x40
[ 343.258219] ? _raw_spin_unlock_irqrestore+0x29/0x40
[ 343.258899] ? __kasan_init_slab_obj+0x24/0x30
[ 343.259529] ? setup_object.isra.71+0x23/0x90
[ 343.260121] ? new_slab+0x26e/0x4b0
[ 343.260609] ? kasan_poison+0x3a/0x50
[ 343.261118] ? kasan_unpoison+0x28/0x50
[ 343.261637] ? __kasan_slab_alloc+0x71/0x90
[ 343.262214] ? memcpy+0x4d/0x60
[ 343.262674] ? write_comp_data+0x2f/0x90
[ 343.263209] ? __kasan_check_write+0x14/0x20
[ 343.263802] ? __skb_clone+0x5d6/0x840
[ 343.264329] ? __sanitizer_cov_trace_pc+0x21/0x60
[ 343.264958] dev_queue_xmit+0x1c/0x20
[ 343.265470] netlink_deliver_tap+0x652/0x9c0
[ 343.266067] netlink_unicast+0x5a0/0x7f0
[ 343.266608] ? netlink_attachskb+0x860/0x860
[ 343.267183] ? __sanitizer_cov_trace_pc+0x21/0x60
[ 343.267820] ? write_comp_data+0x2f/0x90
[ 343.268367] netlink_sendmsg+0x922/0xe80
[ 343.268899] ? netlink_unicast+0x7f0/0x7f0
[ 343.269472] ? __sanitizer_cov_trace_pc+0x21/0x60
[ 343.270099] ? write_comp_data+0x2f/0x90
[ 343.270644] ? netlink_unicast+0x7f0/0x7f0
[ 343.271210] sock_sendmsg+0x155/0x190
[ 343.271721] ____sys_sendmsg+0x75f/0x8f0
[ 343.272262] ? kernel_sendmsg+0x60/0x60
[ 343.272788] ? write_comp_data+0x2f/0x90
[ 343.273332] ? write_comp_data+0x2f/0x90
[ 343.273869] ___sys_sendmsg+0x10f/0x190
[ 343.274405] ? sendmsg_copy_msghdr+0x80/0x80
[ 343.274984] ? slab_post_alloc_hook+0x70/0x230
[ 343.275597] ? futex_wait_setup+0x240/0x240
[ 343.276175] ? security_file_alloc+0x3e/0x170
[ 343.276779] ? write_comp_d
---truncated---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于af_netlink组件缺少对skb的长度检查。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-47606
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47606
请登录查看更多情报信息。
Other References for CVE-2021-47606 (7)
Same Patch Batch · Linux · 2024-06-19 · 122 CVEs total
| CVE-2024-38558 | 10.0 CRITICAL | net: openvswitch: fix overwriting ct original tuple for ICMPv6 |
| CVE-2024-38570 | 9.8 CRITICAL | gfs2: Fix potential glock use-after-free on unmount |
| CVE-2021-47587 | 9.8 CRITICAL | net: systemport: Add global locking for descriptor lifecycle |
| CVE-2024-38544 | 9.8 CRITICAL | RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt |
| CVE-2021-47611 | 8.1 HIGH | mac80211: validate extended element ID is present |
| CVE-2024-38587 | 7.8 HIGH | speakup: Fix sizeof() vs ARRAY_SIZE() bug |
| CVE-2024-38556 | 7.8 HIGH | net/mlx5: Add a timeout to acquire the command queue semaphore |
| CVE-2024-38610 | 7.8 HIGH | drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() |
| CVE-2024-38605 | 7.8 HIGH | ALSA: core: Fix NULL module pointer assignment at card init |
| CVE-2024-38599 | 7.8 HIGH | jffs2: prevent xattr node from overflowing the eraseblock |
| CVE-2024-38592 | 7.8 HIGH | drm/mediatek: Init `ddp_comp` with devm_kcalloc() |
| CVE-2024-38564 | 7.8 HIGH | bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE |
| CVE-2024-38568 | 7.8 HIGH | drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group |
| CVE-2024-38572 | 7.8 HIGH | wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() |
| CVE-2024-38578 | 7.8 HIGH | ecryptfs: Fix buffer size for tag 66 packet |
| CVE-2024-38580 | 7.8 HIGH | epoll: be better about file lifetimes |
| CVE-2024-38569 | 7.8 HIGH | drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group |
| CVE-2024-38583 | 7.8 HIGH | nilfs2: fix use-after-free of timer for log writer thread |
| CVE-2024-38614 | 7.8 HIGH | openrisc: traps: Don't send signals to kernel mode threads |
| CVE-2024-38588 | 7.8 HIGH | ftrace: Fix possible use-after-free issue in ftrace_location() |
Showing top 20 of 122 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2021-47606
No comments yet