UBUNTU-CVE-2021-47245: Low severity ubuntu/linux-azure vulnerability

Q: What traffic is needed to reach the vulnerable parsing path?

The issue is triggered while synproxy parses TCP options. A TCP option with a declared remaining length of one byte, whose opcode is neither TCPOPT_EOL nor TCPOPT_NOP, can cause the parser to read one byte beyond the available option data.

Q: Which Ubuntu kernel package families are listed as affected?

The listed software includes ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-fips, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, and ubuntu/linux-gcp-fips.

Q: What code-level condition does the fix add?

The fix prevents the extra option-length read when insufficient data is available. It also returns early when the length is negative, avoiding a call to skb_header_pointer with a negative length.

Published May 21, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: Fix out of bounds when parsing TCP options The TCP option parser in synproxy (synproxyparseoptions) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPTEOL nor TCPOPTNOP, it reads one more byte, which exceeds the length of 1. This fix is inspired by commit 9609dad263f8 ("ipv4: tcpinput: fix stack out of bounds when parsing TCP options."). v2 changes: Added an early return when length < 0 to avoid calling skbheaderpointer with negative length.

Affected Software

118 affected componentsFixes available

ubuntu/linux-azure<4.15.0-1123.136~14.04.1

4.15.0-1123.136~14.04.1

ubuntu/linux*

ubuntu/linux-aws<4.4.0-1143.149

4.4.0-1143.149

ubuntu/linux-lts-xenial<4.4.0-268.302~14.04.1

4.4.0-268.302~14.04.1

ubuntu/linux<4.4.0-268.302

4.4.0-268.302

ubuntu/linux-aws<4.4.0-1181.196

4.4.0-1181.196

ubuntu/linux-aws-hwe<4.15.0-1111.118~16.04.1

4.15.0-1111.118~16.04.1

ubuntu/linux-azure<4.15.0-1123.136~16.04.1

4.15.0-1123.136~16.04.1

ubuntu/linux-gcp<4.15.0-1108.122~16.04.1

4.15.0-1108.122~16.04.1

ubuntu/linux-hwe<4.15.0-156.163~16.04.1

4.15.0-156.163~16.04.1

ubuntu/linux-kvm<4.4.0-1144.155

4.4.0-1144.155

ubuntu/linux-oracle<4.15.0-1080.88~16.04.1

4.15.0-1080.88~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-fips<4.4.0-1113.120

4.4.0-1113.120

ubuntu/linux-fips*

ubuntu/linux<4.15.0-156.163

4.15.0-156.163

ubuntu/linux-aws<4.15.0-1111.118

4.15.0-1111.118

ubuntu/linux-aws-5.4<5.4.0-1055.58~18.04.1

5.4.0-1055.58~18.04.1

ubuntu/linux-azure-4.15<4.15.0-1123.136

4.15.0-1123.136

ubuntu/linux-azure-5.4<5.4.0-1056.58~18.04.1

5.4.0-1056.58~18.04.1

ubuntu/linux-gcp-4.15<4.15.0-1108.122

4.15.0-1108.122

ubuntu/linux-gcp-5.4<5.4.0-1051.55~18.04.1

5.4.0-1051.55~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-81.91~18.04.1

5.4.0-81.91~18.04.1

ubuntu/linux-kvm<4.15.0-1099.101

4.15.0-1099.101

ubuntu/linux-oracle<4.15.0-1080.88

4.15.0-1080.88

ubuntu/linux-oracle-5.4<5.4.0-1053.57~18.04.1

5.4.0-1053.57~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1042.46~18.04.3

5.4.0-1042.46~18.04.3

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2053.55

4.15.0-2053.55

ubuntu/linux-azure-fips<4.15.0-2035.39

4.15.0-2035.39

ubuntu/linux-fips<4.15.0-1069.78

4.15.0-1069.78

ubuntu/linux-gcp-fips<4.15.0-2018.20

4.15.0-2018.20

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-81.91

5.4.0-81.91

ubuntu/linux-aws<5.4.0-1055.58

5.4.0-1055.58

ubuntu/linux-azure<5.4.0-1056.58

5.4.0-1056.58

ubuntu/linux-bluefield<5.4.0-1019.22

5.4.0-1019.22

ubuntu/linux-gcp<5.4.0-1051.55

5.4.0-1051.55

ubuntu/linux-gkeop<5.4.0-1022.23

5.4.0-1022.23

ubuntu/linux-kvm<5.4.0-1045.47

5.4.0-1045.47

ubuntu/linux-oracle<5.4.0-1053.57

5.4.0-1053.57

ubuntu/linux-raspi<5.4.0-1042.46

5.4.0-1042.46

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1069.73+fips2

5.4.0-1069.73+fips2

ubuntu/linux-azure-fips<5.4.0-1073.76+fips1

5.4.0-1073.76+fips1

ubuntu/linux-fips<5.4.0-1032.37

5.4.0-1032.37

ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1

5.4.0-1067.71~20.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1123.136~14.04.1
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1143.149
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-268.302~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-268.302
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1181.196
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1111.118~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1123.136~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1108.122~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-156.163~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1144.155
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1080.88~16.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1113.120
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-156.163
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1111.118
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1055.58~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1123.136
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.58~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1108.122
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.55~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-81.91~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1099.101
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1080.88
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1053.57~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1042.46~18.04.3
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2053.55
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2035.39
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1069.78
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2018.20
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-81.91
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1055.58
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.58
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1019.22
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.55
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1022.23
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1045.47
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1053.57
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1042.46
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73+fips2
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1032.37
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.71~20.04.1

Event History

May 21, 2024

CVE Published

via OSV·03:15 PM

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What traffic is needed to reach the vulnerable parsing path?

The issue is triggered while synproxy parses TCP options. A TCP option with a declared remaining length of one byte, whose opcode is neither TCPOPT_EOL nor TCPOPT_NOP, can cause the parser to read one byte beyond the available option data.

Which Ubuntu kernel package families are listed as affected?

The listed software includes ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-fips, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, and ubuntu/linux-gcp-fips.

What code-level condition does the fix add?

The fix prevents the extra option-length read when insufficient data is available. It also returns early when the length is negative, avoiding a call to skb_header_pointer with a negative length.

UBUNTU-CVE-2021-47245: Low severity ubuntu/linux-azure vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What traffic is needed to reach the vulnerable parsing path?

Which Ubuntu kernel package families are listed as affected?

What code-level condition does the fix add?

Company

Resources

Contact

Frequently Asked Questions

What traffic is needed to reach the vulnerable parsing path?

Which Ubuntu kernel package families are listed as affected?

What code-level condition does the fix add?