{
  "cveId": "CVE-2021-47399",
  "url": "https://patchblox.com/security/cve/CVE-2021-47399",
  "summary": "CVE-2021-47399 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47399, released May 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ixgbe: Fix NULL pointer dereference in ixgbe_xdp...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup  The ixgbe driver currently generates a NULL pointer dereference with some machine (online cpus \u003C 63). This is due to the fact that the maximum value of num_xdp_queues is nr_cpu_ids. Code is in \u0022ixgbe_set_rss_queues\u0022\u0022.  Here\u0027s how the problem repeats itself: Some machine (online cpus \u003C 63), And user set num_queues to 63 through ethtool. Code is in the \u0022ixgbe_set_channels\u0022, \tadapter-\u003Ering_feature[RING_F_FDIR].limit = count;  It becomes 63.  When user use xdp, \u0022ixgbe_set_rss_queues\u0022 will set queues num. \tadapter-\u003Enum_rx_queues = rss_i; \tadapter-\u003Enum_tx_queues = rss_i; \tadapter-\u003Enum_xdp_queues = ixgbe_xdp_queues(adapter);  And rss_i\u0027s value is from \tf = \u0026adapter-\u003Ering_feature[RING_F_FDIR]; \trss_i = f-\u003Eindices = f-\u003Elimit;  So \u0022num_rx_queues\u0022 \u003E \u0022num_xdp_queues\u0022, when run to \u0022ixgbe_xdp_setup\u0022, \tfor (i = 0; i \u003C adapter-\u003Enum_rx_queues; i\u002B\u002B) \t\tif (adapter-\u003Exdp_ring[i]-\u003Exsk_umem)  It leads to panic.  Call trace: [exception RIP: ixgbe_xdp\u002B368] RIP: ffffffffc02a76a0  RSP: ffff9fe16202f8d0  RFLAGS: 00010297 RAX: 0000000000000000  RBX: 0000000000000020  RCX: 0000000000000000 RDX: 0000000000000000  RSI: 000000000000001c  RDI: ffffffffa94ead90 RBP: ffff92f8f24c0c18   R8: 0000000000000000   R9: 0000000000000000 R10: ffff9fe16202f830  R11: 0000000000000000  R12: ffff92f8f24c0000 R13: ffff9fe16202fc01  R14: 000000000000000a  R15: ffffffffc02a7530 ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018  7 [ffff9fe16202f8f0] dev_xdp_install at ffffffffa89fbbcc  8 [ffff9fe16202f920] dev_change_xdp_fd at ffffffffa8a08808  9 [ffff9fe16202f960] do_setlink at ffffffffa8a20235 10 [ffff9fe16202fa88] rtnl_setlink at ffffffffa8a20384 11 [ffff9fe16202fc78] rtnetlink_rcv_msg at ffffffffa8a1a8dd 12 [ffff9fe16202fcf0] netlink_rcv_skb at ffffffffa8a717eb 13 [ffff9fe16202fd40] netlink_unicast at ffffffffa8a70f88 14 [ffff9fe16202fd80] netlink_sendmsg at ffffffffa8a71319 15 [ffff9fe16202fdf0] sock_sendmsg at ffffffffa89df290 16 [ffff9fe16202fe08] __sys_sendto at ffffffffa89e19c8 17 [ffff9fe16202ff30] __x64_sys_sendto at ffffffffa89e1a64 18 [ffff9fe16202ff38] do_syscall_64 at ffffffffa84042b9 19 [ffff9fe16202ff50] entry_SYSCALL_64_after_hwframe at ffffffffa8c0008c  So I fix ixgbe_max_channels so that it will not allow a setting of queues to be higher than the num_online_cpus(). And when run to ixgbe_xdp_setup, take the smaller value of num_rx_queues and num_xdp_queues.",
  "published": "2024-05-21T15:15:25Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00241,
  "epssPercentile": 0.15273,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.14.12-1",
      "fix": "DEBIAN-CVE-2021-47399",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47399",
      "released": "2024-05-21T15:15:25Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.14.12-1",
      "fix": "DEBIAN-CVE-2021-47399",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47399",
      "released": "2024-05-21T15:15:25Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.14.12-1",
      "fix": "DEBIAN-CVE-2021-47399",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47399",
      "released": "2024-05-21T15:15:25Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}