# CVE-2021-47597: linux: In the Linux kernel, the following vulnerability has been resolved:  inet_diag: fix kernel-infoleak for UDP sockets...

CVE-2021-47597 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47597, released June 19, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2021-47597
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0025
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 19, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  inet_diag: fix kernel-infoleak for UDP sockets  KMSAN reported a kernel-infoleak [1], that can exploited by unpriv users.  After analysis it turned out UDP was not initializing r->idiag_expires. Other users of inet_sk_diag_fill() might make the same mistake in the future, so fix this in inet_sk_diag_fill().  [1] BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:156 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x69d/0x25c0 lib/iov_iter.c:670  instrument_copy_to_user include/linux/instrumented.h:121 [inline]  copyout lib/iov_iter.c:156 [inline]  _copy_to_iter+0x69d/0x25c0 lib/iov_iter.c:670  copy_to_iter include/linux/uio.h:155 [inline]  simple_copy_to_iter+0xf3/0x140 net/core/datagram.c:519  __skb_datagram_iter+0x2cb/0x1280 net/core/datagram.c:425  skb_copy_datagram_iter+0xdc/0x270 net/core/datagram.c:533  skb_copy_datagram_msg include/linux/skbuff.h:3657 [inline]  netlink_recvmsg+0x660/0x1c60 net/netlink/af_netlink.c:1974  sock_recvmsg_nosec net/socket.c:944 [inline]  sock_recvmsg net/socket.c:962 [inline]  sock_read_iter+0x5a9/0x630 net/socket.c:1035  call_read_iter include/linux/fs.h:2156 [inline]  new_sync_read fs/read_write.c:400 [inline]  vfs_read+0x1631/0x1980 fs/read_write.c:481  ksys_read+0x28c/0x520 fs/read_write.c:619  __do_sys_read fs/read_write.c:629 [inline]  __se_sys_read fs/read_write.c:627 [inline]  __x64_sys_read+0xdb/0x120 fs/read_write.c:627  do_syscall_x64 arch/x86/entry/common.c:51 [inline]  do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82  entry_SYSCALL_64_after_hwframe+0x44/0xae  Uninit was created at:  slab_post_alloc_hook mm/slab.h:524 [inline]  slab_alloc_node mm/slub.c:3251 [inline]  __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974  kmalloc_reserve net/core/skbuff.c:354 [inline]  __alloc_skb+0x545/0xf90 net/core/skbuff.c:426  alloc_skb include/linux/skbuff.h:1126 [inline]  netlink_dump+0x3d5/0x16a0 net/netlink/af_netlink.c:2245  __netlink_dump_start+0xd1c/0xee0 net/netlink/af_netlink.c:2370  netlink_dump_start include/linux/netlink.h:254 [inline]  inet_diag_handler_cmd+0x2e7/0x400 net/ipv4/inet_diag.c:1343  sock_diag_rcv_msg+0x24a/0x620  netlink_rcv_skb+0x447/0x800 net/netlink/af_netlink.c:2491  sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:276  netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]  netlink_unicast+0x1095/0x1360 net/netlink/af_netlink.c:1345  netlink_sendmsg+0x16f3/0x1870 net/netlink/af_netlink.c:1916  sock_sendmsg_nosec net/socket.c:704 [inline]  sock_sendmsg net/socket.c:724 [inline]  sock_write_iter+0x594/0x690 net/socket.c:1057  do_iter_readv_writev+0xa7f/0xc70  do_iter_write+0x52c/0x1500 fs/read_write.c:851  vfs_writev fs/read_write.c:924 [inline]  do_writev+0x63f/0xe30 fs/read_write.c:967  __do_sys_writev fs/read_write.c:1040 [inline]  __se_sys_writev fs/read_write.c:1037 [inline]  __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037  do_syscall_x64 arch/x86/entry/common.c:51 [inline]  do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82  entry_SYSCALL_64_after_hwframe+0x44/0xae  Bytes 68-71 of 312 are uninitialized Memory access of size 312 starts at ffff88812ab54000 Data copied to user address 0000000020001440  CPU: 1 PID: 6365 Comm: syz-executor801 Not tainted 5.16.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.15.15-1 | [DEBIAN-CVE-2021-47597](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47597.md) | Jun 19, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.15.15-1 | [DEBIAN-CVE-2021-47597](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47597.md) | Jun 19, 2024 |
| Linux | linux Debian 14 | 5.15.15-1 | [DEBIAN-CVE-2021-47597](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47597.md) | Jun 19, 2024 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.