CVE-2021-47309

net: validate lwtstate->data before returning from skb_tunnel_info()

State: Published
Severity: 7.8 High
Published: May 21, 2024
Updated: Aug 5, 2026
Reserved: May 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: validate lwtstate->data before returning from skb_tunnel_info()

skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible. So skb_tunnel_info() should validate before returning that pointer.

Splat looks like: BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811

CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 Call Trace: dump_stack_lvl+0x56/0x7b print_address_description.constprop.8.cold.13+0x13/0x2ee ? vxlan_get_route+0x418/0x4b0 [vxlan] ? vxlan_get_route+0x418/0x4b0 [vxlan] kasan_report.cold.14+0x83/0xdf ? vxlan_get_route+0x418/0x4b0 [vxlan] vxlan_get_route+0x418/0x4b0 [vxlan] [ ... ] vxlan_xmit_one+0x148b/0x32b0 [vxlan] [ ... ] vxlan_xmit+0x25c5/0x4780 [vxlan] [ ... ] dev_hard_start_xmit+0x1ae/0x6e0 __dev_queue_xmit+0x1f39/0x31a0 [ ... ] neigh_xmit+0x2f9/0x940 mpls_xmit+0x911/0x1600 [mpls_iptunnel] lwtunnel_xmit+0x18f/0x450 ip_finish_output2+0x867/0x2040 [ ... ]

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before e7f3c9df40515a6c6b46f36c4c94cf48a043f887Affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before b61d327cd3cc5ea591f3bf751dd11e034f388bb5Affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before 83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0dAffected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before 8bb1589c89e61e3b182dd546f1021928ebb5c2a6Affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before 8aa13a86964cdec4fd969ef677c6614ff068641aAffected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before 2179d96ec702cc33ead02a9ce40ece599b8538c5Affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before a915379594f1e045421635c6316d8f3ffa018c58Affected 61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before 67a9c94317402b826fc3db32afc8f39336803d97Affected
LinuxLinux	4.3Affected before 4.3Not affected 4.4.277 through 4.4.Not affected 4.9.277 through 4.9.Not affected 4.14.241 through 4.14.Not affected 4.19.199 through 4.19.Not affected 5.4.135 through 5.4.Not affected 5.10.53 through 5.10.Not affected 5.13.5 through 5.13.*Not affected 5.14 and laterNot affected

Product

Versions

LinuxLinux

61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before e7f3c9df40515a6c6b46f36c4c94cf48a043f887Affected
61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before b61d327cd3cc5ea591f3bf751dd11e034f388bb5Affected
61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before 83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0dAffected
61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before 8bb1589c89e61e3b182dd546f1021928ebb5c2a6Affected
61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before 8aa13a86964cdec4fd969ef677c6614ff068641aAffected
61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before 2179d96ec702cc33ead02a9ce40ece599b8538c5Affected
61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before a915379594f1e045421635c6316d8f3ffa018c58Affected
61adedf3e3f1d3f032c5a6a299978d91eff6d555 to before 67a9c94317402b826fc3db32afc8f39336803d97Affected

LinuxLinux

4.3Affected
before 4.3Not affected
4.4.277 through 4.4.*Not affected
4.9.277 through 4.9.*Not affected
4.14.241 through 4.14.*Not affected
4.19.199 through 4.19.*Not affected
5.4.135 through 5.4.*Not affected
5.10.53 through 5.10.*Not affected
5.13.5 through 5.13.*Not affected
5.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.