CVE-2021-47146: mld: fix panic in mld_newpack()

Published Mar 25, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mld: fix panic in mldnewpack()

mldnewpack() doesn't allow to allocate high order page, only order-0 allocation is allowed. If headroom size is too large, a kernel panic could occur in skbput().

Test commands: ip netns del A ip netns del B ip netns add A ip netns add B ip link add veth0 type veth peer name veth1 ip link set veth0 netns A ip link set veth1 netns B

ip netns exec A ip link set lo up ip netns exec A ip link set veth0 up ip netns exec A ip -6 a a 2001:db8:0::1/64 dev veth0 ip netns exec B ip link set lo up ip netns exec B ip link set veth1 up ip netns exec B ip -6 a a 2001:db8:0::2/64 dev veth1 for i in {1..99} do let A=$i-1 ip netns exec A ip link add ip6gre$i type ip6gre \ local 2001:db8:$A::1 remote 2001:db8:$A::2 encaplimit 100 ip netns exec A ip -6 a a 2001:db8:$i::1/64 dev ip6gre$i ip netns exec A ip link set ip6gre$i up

ip netns exec B ip link add ip6gre$i type ip6gre \ local 2001:db8:$A::2 remote 2001:db8:$A::1 encaplimit 100 ip netns exec B ip -6 a a 2001:db8:$i::2/64 dev ip6gre$i ip netns exec B ip link set ip6gre$i up done

Splat looks like: kernel BUG at net/core/skbuff.c:110! invalid opcode: 0000 [#1] SMP DEBUGPAGEALLOC KASAN PTI CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.12.0+ #891 Workqueue: ipv6addrconf addrconfdadwork RIP: 0010:skbpanic+0x15d/0x15f Code: 92 fe 4c 8b 4c 24 10 53 8b 4d 70 45 89 e0 48 c7 c7 00 ae 79 83 41 57 41 56 41 55 48 8b 54 24 a6 26 f9 ff <0f> 0b 48 8b 6c 24 20 89 34 24 e8 4a 4e 92 fe 8b 34 24 48 c7 c1 20 RSP: 0018:ffff88810091f820 EFLAGS: 00010282 RAX: 0000000000000089 RBX: ffff8881086e9000 RCX: 0000000000000000 RDX: 0000000000000089 RSI: 0000000000000008 RDI: ffffed1020123efb RBP: ffff888005f6eac0 R08: ffffed1022fc0031 R09: ffffed1022fc0031 R10: ffff888117e00187 R11: ffffed1022fc0030 R12: 0000000000000028 R13: ffff888008284eb0 R14: 0000000000000ed8 R15: 0000000000000ec0 FS: 0000000000000000(0000) GS:ffff888117c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8b801c5640 CR3: 0000000033c2c006 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? ip6mchdr.isra.26.constprop.46+0x12a/0x600 ? ip6mchdr.isra.26.constprop.46+0x12a/0x600 skbput.cold.104+0x22/0x22 ip6mchdr.isra.26.constprop.46+0x12a/0x600 ? rcureadlockschedheld+0x91/0xc0 mldnewpack+0x398/0x8f0 ? ip6mchdr.isra.26.constprop.46+0x600/0x600 ? lockcontended+0xc40/0xc40 addgrhead.isra.33+0x280/0x380 addgrec+0x5ca/0xff0 ? mldsendpack+0xf40/0xf40 ? lockdowngrade+0x690/0x690 mldsendinitialcr.part.34+0xb9/0x180 ipv6mcdadcomplete+0x15d/0x1b0 addrconfdadcompleted+0x8d2/0xbb0 ? lockdowngrade+0x690/0x690 ? addrconfrstimer+0x660/0x660 ? addrconfdadwork+0x73c/0x10e0 addrconfdadwork+0x73c/0x10e0

Allowing high order page allocation could fix this problem.

Affected Software

128 affected componentsFixes available
Linux Linux kernel>=2.6.35<4.4.271
Linux Linux kernel>=4.5<4.9.271
Linux Linux kernel>=4.10<4.14.235
Linux Linux kernel>=4.15<4.19.193
Linux Linux kernel>=4.20<5.4.124
Linux Linux kernel>=5.5<5.10.42
Linux Linux kernel>=5.11<5.12.9
Linux Linux kernel=5.13-rc1
Linux Linux kernel=5.13-rc2
Linux Linux kernel=5.13-rc3
ubuntu/linux-azure<4.15.0-1121.134~14.04.1
4.15.0-1121.134~14.04.1
ubuntu/linux*
ubuntu/linux-aws<4.4.0-1150.156
4.4.0-1150.156
ubuntu/linux-lts-xenial<4.4.0-276.310~14.04.1
4.4.0-276.310~14.04.1
ubuntu/linux<4.4.0-276.310
4.4.0-276.310
ubuntu/linux-aws<4.4.0-1188.203
4.4.0-1188.203
ubuntu/linux-aws-hwe<4.15.0-1109.116~16.04.1
4.15.0-1109.116~16.04.1
ubuntu/linux-azure<4.15.0-1121.134~16.04.1
4.15.0-1121.134~16.04.1
ubuntu/linux-gcp<4.15.0-1106.120~16.04.1
4.15.0-1106.120~16.04.1
ubuntu/linux-hwe<4.15.0-151.157~16.04.1
4.15.0-151.157~16.04.1
ubuntu/linux-kvm<4.4.0-1151.162
4.4.0-1151.162
ubuntu/linux-oracle<4.15.0-1078.86~16.04.1
4.15.0-1078.86~16.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-fips<4.4.0-1120.127
4.4.0-1120.127
ubuntu/linux-fips*
ubuntu/linux<4.15.0-151.157
4.15.0-151.157
ubuntu/linux-aws<4.15.0-1109.116
4.15.0-1109.116
ubuntu/linux-aws-5.4<5.4.0-1054.57~18.04.1
5.4.0-1054.57~18.04.1
ubuntu/linux-azure-4.15<4.15.0-1121.134
4.15.0-1121.134
ubuntu/linux-azure-5.4<5.4.0-1055.57~18.04.1
5.4.0-1055.57~18.04.1
ubuntu/linux-gcp-4.15<4.15.0-1106.120
4.15.0-1106.120
ubuntu/linux-gcp-5.4<5.4.0-1049.53~18.04.1
5.4.0-1049.53~18.04.1
ubuntu/linux-hwe-5.4<5.4.0-80.90~18.04.1
5.4.0-80.90~18.04.1
ubuntu/linux-kvm<4.15.0-1097.99
4.15.0-1097.99
ubuntu/linux-oracle<4.15.0-1078.86
4.15.0-1078.86
ubuntu/linux-oracle-5.4<5.4.0-1052.56~18.04.1
5.4.0-1052.56~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1041.45~18.04.1
5.4.0-1041.45~18.04.1
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-fips<4.15.0-2051.53
4.15.0-2051.53
ubuntu/linux-azure-fips<4.15.0-2033.37
4.15.0-2033.37
ubuntu/linux-fips<4.15.0-1066.75
4.15.0-1066.75
ubuntu/linux-gcp-fips<4.15.0-2016.18
4.15.0-2016.18
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-80.90
5.4.0-80.90
ubuntu/linux-aws<5.4.0-1054.57
5.4.0-1054.57
ubuntu/linux-azure<5.4.0-1055.57
5.4.0-1055.57
ubuntu/linux-bluefield<5.4.0-1016.19
5.4.0-1016.19
ubuntu/linux-gcp<5.4.0-1049.53
5.4.0-1049.53
ubuntu/linux-gkeop<5.4.0-1021.22
5.4.0-1021.22
ubuntu/linux-kvm<5.4.0-1044.46
5.4.0-1044.46
ubuntu/linux-oracle<5.4.0-1052.56
5.4.0-1052.56
ubuntu/linux-raspi<5.4.0-1041.45
5.4.0-1041.45
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1069.73+fips2
5.4.0-1069.73+fips2
ubuntu/linux-azure-fips<5.4.0-1073.76+fips1
5.4.0-1073.76+fips1
ubuntu/linux-fips<5.4.0-1031.36
5.4.0-1031.36
ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1
5.4.0-1067.71~20.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1121.134~14.04.1
  2. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1150.156
  3. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-276.310~14.04.1
  4. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-276.310
  5. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1188.203
  6. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1109.116~16.04.1
  7. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1121.134~16.04.1
  8. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1106.120~16.04.1
  9. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-151.157~16.04.1
  10. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1151.162
  11. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1078.86~16.04.1
  12. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1120.127
  13. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-151.157
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1109.116
  15. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1054.57~18.04.1
  16. Upgrade

    Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1121.134
  17. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1055.57~18.04.1
  18. Upgrade

    Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1106.120
  19. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1049.53~18.04.1
  20. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-80.90~18.04.1
  21. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1097.99
  22. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1078.86
  23. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1052.56~18.04.1
  24. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1041.45~18.04.1
  25. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2051.53
  26. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2033.37
  27. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1066.75
  28. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2016.18
  29. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-80.90
  30. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1054.57
  31. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1055.57
  32. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1016.19
  33. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1049.53
  34. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.4.0-1021.22
  35. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1044.46
  36. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1052.56
  37. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1041.45
  38. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1069.73+fips2
  39. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1073.76+fips1
  40. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1031.36
  41. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1067.71~20.04.1
  42. Compensating control

    Allow high-order page allocation in mld_newpack() to address the panic caused by excessive headroom in skb_put().

Event History

Mar 25, 2024
CVE Published
via MITRE·09:07 AM
Data Sourced
via MITRE·09:07 AM
Description
Data Sourced
via OSV·09:15 AM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2021-47146?

CVE-2021-47146 has a medium severity level due to the potential for kernel panic during high order page allocation.

2

How do I fix CVE-2021-47146?

To fix CVE-2021-47146, users should update the Linux kernel to a version that addresses the vulnerability.

3

Which Linux kernel versions are affected by CVE-2021-47146?

CVE-2021-47146 affects Linux kernel versions between 2.6.35 and 5.13-rc3, specifically within defined version ranges in those releases.

4

What happens if CVE-2021-47146 is exploited?

If exploited, CVE-2021-47146 can lead to a kernel panic, causing system instability and potential crashes.

5

Who is responsible for addressing CVE-2021-47146?

The responsibility for addressing CVE-2021-47146 lies with the maintainers of the affected Linux kernel distributions and users who need to apply updates.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203