CVE-2021-47010

net: Only allow init netns to set default tcp cong to a restricted algo

State: Published
Severity: 7.8 High
Published: Feb 28, 2024
Updated: May 11, 2026
Reserved: Feb 27, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: Only allow init netns to set default tcp cong to a restricted algo

tcp_set_default_congestion_control() is netns-safe in that it writes to &net->ipv4.tcp_congestion_control, but it also sets ca->flags |= TCP_CONG_NON_RESTRICTED which is not namespaced. This has the unintended side-effect of changing the global net.ipv4.tcp_allowed_congestion_control sysctl, despite the fact that it is read-only: 97684f0970f6 ("net: Make tcp_allowed_congestion_control readonly in non-init netns")

Resolve this netns "leak" by only allowing the init netns to set the default algorithm to one that is restricted. This restriction could be removed if tcp_allowed_congestion_control were namespace-ified in the future.

This bug was uncovered with https://github.com/JonathonReinhart/linux-netns-sysctl-verify

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
LinuxLinux	6670e152447732ba90626f36dfc015a13fbf150e to before 992de06308d9a9584d59b96d294ac676f924e437Affected 6670e152447732ba90626f36dfc015a13fbf150e to before 9884f745108f7d25b189bbcd6754e284fb29ab68Affected 6670e152447732ba90626f36dfc015a13fbf150e to before 6c1ea8bee75df8fe2184a50fcd0f70bf82986f42Affected 6670e152447732ba90626f36dfc015a13fbf150e to before efe1532a6e1a8e3c343d04fff510f0ed80328f9cAffected 6670e152447732ba90626f36dfc015a13fbf150e to before e7d7bedd507bb732e600403b7a96f9fe48d0ca31Affected 6670e152447732ba90626f36dfc015a13fbf150e to before 8d432592f30fcc34ef5a10aac4887b4897884493Affected
LinuxLinux	4.15Affected before 4.15Not affected 4.19.191 through 4.19.Not affected 5.4.119 through 5.4.Not affected 5.10.37 through 5.10.Not affected 5.11.21 through 5.11.Not affected 5.12.4 through 5.12.*Not affected 5.13 and laterNot affected

Product

Versions

LinuxLinux

6670e152447732ba90626f36dfc015a13fbf150e to before 992de06308d9a9584d59b96d294ac676f924e437Affected
6670e152447732ba90626f36dfc015a13fbf150e to before 9884f745108f7d25b189bbcd6754e284fb29ab68Affected
6670e152447732ba90626f36dfc015a13fbf150e to before 6c1ea8bee75df8fe2184a50fcd0f70bf82986f42Affected
6670e152447732ba90626f36dfc015a13fbf150e to before efe1532a6e1a8e3c343d04fff510f0ed80328f9cAffected
6670e152447732ba90626f36dfc015a13fbf150e to before e7d7bedd507bb732e600403b7a96f9fe48d0ca31Affected
6670e152447732ba90626f36dfc015a13fbf150e to before 8d432592f30fcc34ef5a10aac4887b4897884493Affected

LinuxLinux

4.15Affected
before 4.15Not affected
4.19.191 through 4.19.*Not affected
5.4.119 through 5.4.*Not affected
5.10.37 through 5.10.*Not affected
5.11.21 through 5.11.*Not affected
5.12.4 through 5.12.*Not affected
5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.