Log in Start free

Vulnerability · Published May 21, 2024 · Assigned by Linux

CVE-2021-47295net: sched: fix memory leak in tcindex_partial_destroy_work

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.5%top 25.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix memory leak in tcindex_partial_destroy_work Syzbot reported memory leak in tcindex_set_parms(). The problem was in non-freed perfect hash in tcindex_partial_destroy_work(). In tcindex_set_parms() new tcindex_data is allocated and some fields from old one are copied to new one, but not the perfect hash. Since tcindex_partial_destroy_work() is the destroy function for old tcindex_data, we need to free perfect hash to avoid memory leak.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.14.6-1DEBIAN-CVE-2021-47295
Debian:13linux5.14.6-1DEBIAN-CVE-2021-47295
Debian:14linux5.14.6-1DEBIAN-CVE-2021-47295
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47295
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47295
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47295

Affected products (as reported)

VendorProductVersions
Linux Linux 331b72922c5f58d48fd5500acadc91777cc31970 – before 53af9c793f644d5841d84d8e0ad83bd7ab47f3e0331b72922c5f58d48fd5500acadc91777cc31970 – before 01d0d2b8b4e3cf2110baba9371c0c3d04ad5c77b331b72922c5f58d48fd5500acadc91777cc31970 – before 8d7924ce85bae64e7a67c366c7c50840f49f3a62331b72922c5f58d48fd5500acadc91777cc31970 – before 7a6fb69bbcb21e9ce13bdf18c008c268874f0480331b72922c5f58d48fd5500acadc91777cc31970 – before 8e9662fde6d63c78eb1350f6167f64c9d71a865b331b72922c5f58d48fd5500acadc91777cc31970 – before 18c3fa7a7fdbb4d21dafc8a7710ae2c1680930f6331b72922c5f58d48fd5500acadc91777cc31970 – before cac71d27745f92ee13f0ecc668ffe151a4a9c9b1331b72922c5f58d48fd5500acadc91777cc31970 – before f5051bcece50140abd1a11a2d36dc3ec5484fc32
Linux Linux 3.18

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References