{ "cveId": "CVE-2021-47136", "url": "https://patchblox.com/security/cve/CVE-2021-47136", "summary": "CVE-2021-47136 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47136, released March 25, 2024. It is not reported as exploited. Patch Radar priority: Routine.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocat...", "description": "In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocation Function skb_ext_add() doesn\u0027t initialize created skb extension with any value and leaves it up to the user. However, since extension of type TC_SKB_EXT originally contained only single value tc_skb_ext-\u003Echain its users used to just assign the chain value without setting whole extension memory to zero first. This assumption changed when TC_SKB_EXT extension was extended with additional fields but not all users were updated to initialize the new fields which leads to use of uninitialized memory afterwards. UBSAN log: [ 778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28 [ 778.301495] load of value 107 is not a valid value for type \u0027_Bool\u0027 [ 778.303215] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc7\u002B #2 [ 778.304933] Hardware name: QEMU Standard PC (Q35 \u002B ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 778.307901] Call Trace: [ 778.308680] \u003CIRQ\u003E [ 778.309358] dump_stack\u002B0xbb/0x107 [ 778.310307] ubsan_epilogue\u002B0x5/0x40 [ 778.311167] __ubsan_handle_load_invalid_value.cold\u002B0x43/0x48 [ 778.312454] ? memset\u002B0x20/0x40 [ 778.313230] ovs_flow_key_extract.cold\u002B0xf/0x14 [openvswitch] [ 778.314532] ovs_vport_receive\u002B0x19e/0x2e0 [openvswitch] [ 778.315749] ? ovs_vport_find_upcall_portid\u002B0x330/0x330 [openvswitch] [ 778.317188] ? create_prof_cpu_mask\u002B0x20/0x20 [ 778.318220] ? arch_stack_walk\u002B0x82/0xf0 [ 778.319153] ? secondary_startup_64_no_verify\u002B0xb0/0xbb [ 778.320399] ? stack_trace_save\u002B0x91/0xc0 [ 778.321362] ? stack_trace_consume_entry\u002B0x160/0x160 [ 778.322517] ? lock_release\u002B0x52e/0x760 [ 778.323444] netdev_frame_hook\u002B0x323/0x610 [openvswitch] [ 778.324668] ? ovs_netdev_get_vport\u002B0xe0/0xe0 [openvswitch] [ 778.325950] __netif_receive_skb_core\u002B0x771/0x2db0 [ 778.327067] ? lock_downgrade\u002B0x6e0/0x6f0 [ 778.328021] ? lock_acquire\u002B0x565/0x720 [ 778.328940] ? generic_xdp_tx\u002B0x4f0/0x4f0 [ 778.329902] ? inet_gro_receive\u002B0x2a7/0x10a0 [ 778.330914] ? lock_downgrade\u002B0x6f0/0x6f0 [ 778.331867] ? udp4_gro_receive\u002B0x4c4/0x13e0 [ 778.332876] ? lock_release\u002B0x52e/0x760 [ 778.333808] ? dev_gro_receive\u002B0xcc8/0x2380 [ 778.334810] ? lock_downgrade\u002B0x6f0/0x6f0 [ 778.335769] __netif_receive_skb_list_core\u002B0x295/0x820 [ 778.336955] ? process_backlog\u002B0x780/0x780 [ 778.337941] ? mlx5e_rep_tc_netdevice_event_unregister\u002B0x20/0x20 [mlx5_core] [ 778.339613] ? seqcount_lockdep_reader_access.constprop.0\u002B0xa7/0xc0 [ 778.341033] ? kvm_clock_get_cycles\u002B0x14/0x20 [ 778.342072] netif_receive_skb_list_internal\u002B0x5f5/0xcb0 [ 778.343288] ? __kasan_kmalloc\u002B0x7a/0x90 [ 778.344234] ? mlx5e_handle_rx_cqe_mpwrq\u002B0x9e0/0x9e0 [mlx5_core] [ 778.345676] ? mlx5e_xmit_xdp_frame_mpwqe\u002B0x14d0/0x14d0 [mlx5_core] [ 778.347140] ? __netif_receive_skb_list_core\u002B0x820/0x820 [ 778.348351] ? mlx5e_post_rx_mpwqes\u002B0xa6/0x25d0 [mlx5_core] [ 778.349688] ? napi_gro_flush\u002B0x26c/0x3c0 [ 778.350641] napi_complete_done\u002B0x188/0x6b0 [ 778.351627] mlx5e_napi_poll\u002B0x373/0x1b80 [mlx5_core] [ 778.352853] __napi_poll\u002B0x9f/0x510 [ 778.353704] ? mlx5_flow_namespace_set_mode\u002B0x260/0x260 [mlx5_core] [ 778.355158] net_rx_action\u002B0x34c/0xa40 [ 778.356060] ? napi_threaded_poll\u002B0x3d0/0x3d0 [ 778.357083] ? sched_clock_cpu\u002B0x18/0x190 [ 778.358041] ? __common_interrupt\u002B0x8e/0x1a0 [ 778.359045] __do_softirq\u002B0x1ce/0x984 [ 778.359938] __irq_exit_rcu\u002B0x137/0x1d0 [ 778.360865] irq_exit_rcu\u002B0xa/0x20 [ 778.361708] common_interrupt\u002B0x80/0xa0 [ 778.362640] \u003C/IRQ\u003E [ 778.363212] asm_common_interrupt\u002B0x1e/0x40 [ 778.364204] RIP: 0010:native_safe_halt\u002B0xe/0x10 [ 778.365273] Code: 4f ff ff ff 4c 89 e7 e8 50 3f 40 fe e9 dc fe ff ff 48 89 df e8 43 3f 40 fe eb 90 cc e9 07 00 00 00 0f 00 2d 74 05 62 00 fb f4 \u003Cc3\u003E 90 e9 07 00 00 00 0f 00 2d 64 05 62 00 f4 c3 cc cc 0f 1f 44 00 [ 778.369355] RSP: 0018:ffffffff84407e48 EFLAGS: 00000246 [ 778.370570] RAX ---truncated---", "published": "2024-03-25T09:15:07Z", "severity": "medium", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.00544, "epssPercentile": 0.45908, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "linux", "release": "Debian 12.15 (bookworm)", "fixedVersion": "5.14.6-1", "fix": "DEBIAN-CVE-2021-47136", "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47136", "released": "2024-03-25T09:15:07Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "5.14.6-1", "fix": "DEBIAN-CVE-2021-47136", "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47136", "released": "2024-03-25T09:15:07Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "5.14.6-1", "fix": "DEBIAN-CVE-2021-47136", "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47136", "released": "2024-03-25T09:15:07Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T06:59:42Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }