# CVE-2021-47175: linux: In the Linux kernel, the following vulnerability has been resolved:  net/sched: fq_pie: fix OOB access in the traffic...

CVE-2021-47175 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47175, released March 25, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2021-47175
- Priority: High
- CVSS: 7.1 (high)
- EPSS: 0.0024
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 25, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  net/sched: fq_pie: fix OOB access in the traffic path  the following script:    # tc qdisc add dev eth0 handle 0x1 root fq_pie flows 2   # tc qdisc add dev eth0 clsact   # tc filter add dev eth0 egress matchall action skbedit priority 0x10002   # ping 192.0.2.2 -I eth0 -c2 -w1 -q  produces the following splat:   BUG: KASAN: slab-out-of-bounds in fq_pie_qdisc_enqueue+0x1314/0x19d0 [sch_fq_pie]  Read of size 4 at addr ffff888171306924 by task ping/942   CPU: 3 PID: 942 Comm: ping Not tainted 5.12.0+ #441  Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014  Call Trace:   dump_stack+0x92/0xc1   print_address_description.constprop.7+0x1a/0x150   kasan_report.cold.13+0x7f/0x111   fq_pie_qdisc_enqueue+0x1314/0x19d0 [sch_fq_pie]   __dev_queue_xmit+0x1034/0x2b10   ip_finish_output2+0xc62/0x2120   __ip_finish_output+0x553/0xea0   ip_output+0x1ca/0x4d0   ip_send_skb+0x37/0xa0   raw_sendmsg+0x1c4b/0x2d00   sock_sendmsg+0xdb/0x110   __sys_sendto+0x1d7/0x2b0   __x64_sys_sendto+0xdd/0x1b0   do_syscall_64+0x3c/0x80   entry_SYSCALL_64_after_hwframe+0x44/0xae  RIP: 0033:0x7fe69735c3eb  Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 75 42 2c 00 41 89 ca 8b 00 85 c0 75 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 41 57 4d 89 c7 41 56 41 89  RSP: 002b:00007fff06d7fb38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c  RAX: ffffffffffffffda RBX: 000055e961413700 RCX: 00007fe69735c3eb  RDX: 0000000000000040 RSI: 000055e961413700 RDI: 0000000000000003  RBP: 0000000000000040 R08: 000055e961410500 R09: 0000000000000010  R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff06d81260  R13: 00007fff06d7fb40 R14: 00007fff06d7fc30 R15: 000055e96140f0a0   Allocated by task 917:   kasan_save_stack+0x19/0x40   __kasan_kmalloc+0x7f/0xa0   __kmalloc_node+0x139/0x280   fq_pie_init+0x555/0x8e8 [sch_fq_pie]   qdisc_create+0x407/0x11b0   tc_modify_qdisc+0x3c2/0x17e0   rtnetlink_rcv_msg+0x346/0x8e0   netlink_rcv_skb+0x120/0x380   netlink_unicast+0x439/0x630   netlink_sendmsg+0x719/0xbf0   sock_sendmsg+0xe2/0x110   ____sys_sendmsg+0x5ba/0x890   ___sys_sendmsg+0xe9/0x160   __sys_sendmsg+0xd3/0x170   do_syscall_64+0x3c/0x80   entry_SYSCALL_64_after_hwframe+0x44/0xae   The buggy address belongs to the object at ffff888171306800   which belongs to the cache kmalloc-256 of size 256  The buggy address is located 36 bytes to the right of   256-byte region [ffff888171306800, ffff888171306900)  The buggy address belongs to the page:  page:00000000bcfb624e refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x171306  head:00000000bcfb624e order:1 compound_mapcount:0  flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff)  raw: 0017ffffc0010200 dead000000000100 dead000000000122 ffff888100042b40  raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000  page dumped because: kasan: bad access detected   Memory state around the buggy address:   ffff888171306800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ffff888171306880: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc  >ffff888171306900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc                                 ^   ffff888171306980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc   ffff888171306a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb  fix fq_pie traffic path to avoid selecting 'q->flows + q->flows_cnt' as a valid flow: it's an address beyond the allocated memory.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.14.6-1 | [DEBIAN-CVE-2021-47175](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47175.md) | Mar 25, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.14.6-1 | [DEBIAN-CVE-2021-47175](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47175.md) | Mar 25, 2024 |
| Linux | linux Debian 14 | 5.14.6-1 | [DEBIAN-CVE-2021-47175](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47175.md) | Mar 25, 2024 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.