CVE-2021-47496

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47496
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix flipped sign in tls_err_abort() calls sk->sk_err appears to expect a positive value, a convention that ktls doesn't always follow and that leads to memory corruption in other code. For instance, [kworker] tls_encrypt_done(..., err=<negative error from crypto request>) tls_err_abort(.., err) sk->sk_err = err; [task] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk->sk_err) { ret = -sk->sk_err; // ret is positive splice_from_pipe_feed (continued) ret = actor(...) // ret is still positive and interpreted as bytes // written, resulting in underflow of buf->len and // sd->len, leading to huge buf->offset and bogus // addresses computed in later calls to actor() Fix all tls_err_abort() callers to pass a negative error code consistently and centralize the error-prone sign flip there, throwing in a warning to catch future misuse and uninlining the function so it really does only warn once.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105 Patch
https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb Patch
https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a Patch
https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19 Patch
https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105 Patch
https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb Patch
https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a Patch
https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*
History

24 Sep 2025, 19:15

Type Values Removed Values Added
CWE CWE-787
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105 - () https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105 - Patch
References () https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb - () https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb - Patch
References () https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a - () https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a - Patch
References () https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19 - () https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19 - Patch
First Time Linux
Linux linux Kernel

21 Nov 2024, 06:36

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/tls: corrige las llamadas invertidas de tls_err_abort() sk-&gt;sk_err parece esperar un valor positivo, una convención que ktls no siempre sigue y que conduce a daños en la memoria en otro código. Por ejemplo, [kworker] tls_encrypt_done(..., err=) tls_err_abort(.., err) sk-&gt;sk_err = err; [tarea] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk-&gt;sk_err) { ret = -sk-&gt;sk_err; // ret es positivo splice_from_pipe_feed (continuación) ret = actor(...) // ret sigue siendo positivo y se interpreta como bytes // escritos, lo que resulta en un desbordamiento insuficiente de buf-&gt;len y // sd-&gt;len, lo que genera enormes buf-&gt;offset y bogus // direcciones calculadas en llamadas posteriores a actor(). Repare todas las llamadas tls_err_abort() para que pasen un código de error negativo de manera consistente y centralice el cambio de señal propenso a errores allí, lanzando una advertencia para detectar futuros usos indebidos y eliminación de líneas. la función por lo que realmente solo advierte una vez.
References () https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105 - () https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105 -
References () https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb - () https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb -
References () https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a - () https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a -
References () https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19 - () https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19 -

22 May 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-22 09:15

Updated : 2025-09-24 19:15

NVD link : CVE-2021-47496

Mitre link : CVE-2021-47496

CVE.ORG link : CVE-2021-47496

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write