CVE-2021-47132

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47132
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix sk_forward_memory corruption on retransmission MPTCP sk_forward_memory handling is a bit special, as such field is protected by the msk socket spin_lock, instead of the plain socket lock. Currently we have a code path updating such field without handling the relevant lock: __mptcp_retrans() -> __mptcp_clean_una_wakeup() Several helpers in __mptcp_clean_una_wakeup() will update sk_forward_alloc, possibly causing such field corruption, as reported by Matthieu. Address the issue providing and using a new variant of blamed function which explicitly acquires the msk spin lock.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/b5941f066b4ca331db225a976dae1d6ca8cf0ae3 Patch
https://git.kernel.org/stable/c/b9c78b1a95966a7bd2ddae05b73eafc0cda4fba3 Patch
https://git.kernel.org/stable/c/b5941f066b4ca331db225a976dae1d6ca8cf0ae3 Patch
https://git.kernel.org/stable/c/b9c78b1a95966a7bd2ddae05b73eafc0cda4fba3 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
History

13 Mar 2025, 21:24

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/b5941f066b4ca331db225a976dae1d6ca8cf0ae3 - () https://git.kernel.org/stable/c/b5941f066b4ca331db225a976dae1d6ca8cf0ae3 - Patch
References () https://git.kernel.org/stable/c/b9c78b1a95966a7bd2ddae05b73eafc0cda4fba3 - () https://git.kernel.org/stable/c/b9c78b1a95966a7bd2ddae05b73eafc0cda4fba3 - Patch
CPE cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*
CWE CWE-787

21 Nov 2024, 06:35

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: corrige la corrupción de sk_forward_memory en la retransmisión El manejo de MPTCP sk_forward_memory es un poco especial, ya que dicho campo está protegido por el socket msk spin_lock, en lugar del bloqueo de socket simple. Actualmente tenemos una ruta de código que actualiza dicho campo sin manejar el bloqueo relevante: __mptcp_retrans() -> __mptcp_clean_una_wakeup() Varios ayudantes en __mptcp_clean_una_wakeup() actualizarán sk_forward_alloc, posiblemente causando dicha corrupción de campo, según lo informado por Matthieu. Solucione el problema proporcionando y utilizando una nueva variante de la función culpada que adquiere explícitamente el bloqueo de giro msk.
References () https://git.kernel.org/stable/c/b5941f066b4ca331db225a976dae1d6ca8cf0ae3 - () https://git.kernel.org/stable/c/b5941f066b4ca331db225a976dae1d6ca8cf0ae3 -
References () https://git.kernel.org/stable/c/b9c78b1a95966a7bd2ddae05b73eafc0cda4fba3 - () https://git.kernel.org/stable/c/b9c78b1a95966a7bd2ddae05b73eafc0cda4fba3 -

15 Mar 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-15 21:15

Updated : 2025-03-13 21:24

NVD link : CVE-2021-47132

Mitre link : CVE-2021-47132

CVE.ORG link : CVE-2021-47132

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write