Log in Start free

Vulnerability · Published Mar 25, 2024 · Assigned by Linux

CVE-2021-47159net: dsa: fix a crash if ->get_sset_count() fails

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 83.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix a crash if ->get_sset_count() fails If ds->ops->get_sset_count() fails then it "count" is a negative error code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative error code is type promoted to a very high value and the loop will corrupt memory until the system crashes. Fix this by checking for error codes and changing the type of "i" to just int.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.14.6-1DEBIAN-CVE-2021-47159
Debian:13linux5.14.6-1DEBIAN-CVE-2021-47159
Debian:14linux5.14.6-1DEBIAN-CVE-2021-47159
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47159
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47159
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47159

Affected products (as reported)

VendorProductVersions
Linux Linux badf3ada60ab8f76f9488dc8f5c0c57f70682f5a – before 0f2cb08c57edefb0e7b5045e0e3e9980a3d3aa37badf3ada60ab8f76f9488dc8f5c0c57f70682f5a – before ce5355f140a7987011388c7e30c4f8fbe180d3e8badf3ada60ab8f76f9488dc8f5c0c57f70682f5a – before caff86f85512b8e0d9830e8b8b0dfe13c68ce5b6badf3ada60ab8f76f9488dc8f5c0c57f70682f5a – before 7b22466648a4f8e3e94f57ca428d1531866d1373badf3ada60ab8f76f9488dc8f5c0c57f70682f5a – before a269333fa5c0c8e53c92b5a28a6076a28cde3e83
Linux Linux 4.7

References