CVE-2021-47363 (GCVE-0-2021-47363)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:03 – Updated: 2025-05-04 07:09
VLAI?
Title
nexthop: Fix division by zero while replacing a resilient group
Summary
In the Linux kernel, the following vulnerability has been resolved: nexthop: Fix division by zero while replacing a resilient group The resilient nexthop group torture tests in fib_nexthop.sh exposed a possible division by zero while replacing a resilient group [1]. The division by zero occurs when the data path sees a resilient nexthop group with zero buckets. The tests replace a resilient nexthop group in a loop while traffic is forwarded through it. The tests do not specify the number of buckets while performing the replacement, resulting in the kernel allocating a stub resilient table (i.e, 'struct nh_res_table') with zero buckets. This table should never be visible to the data path, but the old nexthop group (i.e., 'oldg') might still be used by the data path when the stub table is assigned to it. Fix this by only assigning the stub table to the old nexthop group after making sure the group is no longer used by the data path. Tested with fib_nexthops.sh: Tests passed: 222 Tests failed: 0 [1] divide error: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 1850 Comm: ping Not tainted 5.14.0-custom-10271-ga86eb53057fe #1107 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:nexthop_select_path+0x2d2/0x1a80 [...] Call Trace: fib_select_multipath+0x79b/0x1530 fib_select_path+0x8fb/0x1c10 ip_route_output_key_hash_rcu+0x1198/0x2da0 ip_route_output_key_hash+0x190/0x340 ip_route_output_flow+0x21/0x120 raw_sendmsg+0x91d/0x2e10 inet_sendmsg+0x9e/0xe0 __sys_sendto+0x23d/0x360 __x64_sys_sendto+0xe1/0x1b0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 283a72a5599e80750699d2021830a294ed9ab3f3 , < e9d32ec26e7f01d1af13bdc687f586362546aa25 (git)
Affected: 283a72a5599e80750699d2021830a294ed9ab3f3 , < 563f23b002534176f49524b5ca0e1d94d8906c40 (git)
Create a notification for this product.
    Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.14.9 , ≤ 5.14.* (semver)
Unaffected: 5.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47363",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T18:38:59.914564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:20.764Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.610Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e9d32ec26e7f01d1af13bdc687f586362546aa25"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/563f23b002534176f49524b5ca0e1d94d8906c40"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/nexthop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e9d32ec26e7f01d1af13bdc687f586362546aa25",
              "status": "affected",
              "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
              "versionType": "git"
            },
            {
              "lessThan": "563f23b002534176f49524b5ca0e1d94d8906c40",
              "status": "affected",
              "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/nexthop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.9",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Fix division by zero while replacing a resilient group\n\nThe resilient nexthop group torture tests in fib_nexthop.sh exposed a\npossible division by zero while replacing a resilient group [1]. The\ndivision by zero occurs when the data path sees a resilient nexthop\ngroup with zero buckets.\n\nThe tests replace a resilient nexthop group in a loop while traffic is\nforwarded through it. The tests do not specify the number of buckets\nwhile performing the replacement, resulting in the kernel allocating a\nstub resilient table (i.e, \u0027struct nh_res_table\u0027) with zero buckets.\n\nThis table should never be visible to the data path, but the old nexthop\ngroup (i.e., \u0027oldg\u0027) might still be used by the data path when the stub\ntable is assigned to it.\n\nFix this by only assigning the stub table to the old nexthop group after\nmaking sure the group is no longer used by the data path.\n\nTested with fib_nexthops.sh:\n\nTests passed: 222\nTests failed:   0\n\n[1]\n divide error: 0000 [#1] PREEMPT SMP KASAN\n CPU: 0 PID: 1850 Comm: ping Not tainted 5.14.0-custom-10271-ga86eb53057fe #1107\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014\n RIP: 0010:nexthop_select_path+0x2d2/0x1a80\n[...]\n Call Trace:\n  fib_select_multipath+0x79b/0x1530\n  fib_select_path+0x8fb/0x1c10\n  ip_route_output_key_hash_rcu+0x1198/0x2da0\n  ip_route_output_key_hash+0x190/0x340\n  ip_route_output_flow+0x21/0x120\n  raw_sendmsg+0x91d/0x2e10\n  inet_sendmsg+0x9e/0xe0\n  __sys_sendto+0x23d/0x360\n  __x64_sys_sendto+0xe1/0x1b0\n  do_syscall_64+0x35/0x80\n  entry_SYSCALL_64_after_hwframe+0x44/0xae"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:09:24.192Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e9d32ec26e7f01d1af13bdc687f586362546aa25"
        },
        {
          "url": "https://git.kernel.org/stable/c/563f23b002534176f49524b5ca0e1d94d8906c40"
        }
      ],
      "title": "nexthop: Fix division by zero while replacing a resilient group",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47363",
    "datePublished": "2024-05-21T15:03:31.189Z",
    "dateReserved": "2024-05-21T14:58:30.809Z",
    "dateUpdated": "2025-05-04T07:09:24.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e9d32ec26e7f01d1af13bdc687f586362546aa25\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/563f23b002534176f49524b5ca0e1d94d8906c40\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.610Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47363\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-23T18:38:59.914564Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T18:41:47.939Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"nexthop: Fix division by zero while replacing a resilient group\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"283a72a5599e80750699d2021830a294ed9ab3f3\", \"lessThan\": \"e9d32ec26e7f01d1af13bdc687f586362546aa25\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"283a72a5599e80750699d2021830a294ed9ab3f3\", \"lessThan\": \"563f23b002534176f49524b5ca0e1d94d8906c40\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv4/nexthop.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.14.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv4/nexthop.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e9d32ec26e7f01d1af13bdc687f586362546aa25\"}, {\"url\": \"https://git.kernel.org/stable/c/563f23b002534176f49524b5ca0e1d94d8906c40\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnexthop: Fix division by zero while replacing a resilient group\\n\\nThe resilient nexthop group torture tests in fib_nexthop.sh exposed a\\npossible division by zero while replacing a resilient group [1]. The\\ndivision by zero occurs when the data path sees a resilient nexthop\\ngroup with zero buckets.\\n\\nThe tests replace a resilient nexthop group in a loop while traffic is\\nforwarded through it. The tests do not specify the number of buckets\\nwhile performing the replacement, resulting in the kernel allocating a\\nstub resilient table (i.e, \u0027struct nh_res_table\u0027) with zero buckets.\\n\\nThis table should never be visible to the data path, but the old nexthop\\ngroup (i.e., \u0027oldg\u0027) might still be used by the data path when the stub\\ntable is assigned to it.\\n\\nFix this by only assigning the stub table to the old nexthop group after\\nmaking sure the group is no longer used by the data path.\\n\\nTested with fib_nexthops.sh:\\n\\nTests passed: 222\\nTests failed:   0\\n\\n[1]\\n divide error: 0000 [#1] PREEMPT SMP KASAN\\n CPU: 0 PID: 1850 Comm: ping Not tainted 5.14.0-custom-10271-ga86eb53057fe #1107\\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014\\n RIP: 0010:nexthop_select_path+0x2d2/0x1a80\\n[...]\\n Call Trace:\\n  fib_select_multipath+0x79b/0x1530\\n  fib_select_path+0x8fb/0x1c10\\n  ip_route_output_key_hash_rcu+0x1198/0x2da0\\n  ip_route_output_key_hash+0x190/0x340\\n  ip_route_output_flow+0x21/0x120\\n  raw_sendmsg+0x91d/0x2e10\\n  inet_sendmsg+0x9e/0xe0\\n  __sys_sendto+0x23d/0x360\\n  __x64_sys_sendto+0xe1/0x1b0\\n  do_syscall_64+0x35/0x80\\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.9\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"5.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:09:24.192Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47363\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:09:24.192Z\", \"dateReserved\": \"2024-05-21T14:58:30.809Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:03:31.189Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.