CVE-2021-47371 (GCVE-0-2021-47371)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:03 – Updated: 2025-05-04 07:09
VLAI?
Title
nexthop: Fix memory leaks in nexthop notification chain listeners
Summary
In the Linux kernel, the following vulnerability has been resolved: nexthop: Fix memory leaks in nexthop notification chain listeners syzkaller discovered memory leaks [1] that can be reduced to the following commands: # ip nexthop add id 1 blackhole # devlink dev reload pci/0000:06:00.0 As part of the reload flow, mlxsw will unregister its netdevs and then unregister from the nexthop notification chain. Before unregistering from the notification chain, mlxsw will receive delete notifications for nexthop objects using netdevs registered by mlxsw or their uppers. mlxsw will not receive notifications for nexthops using netdevs that are not dismantled as part of the reload flow. For example, the blackhole nexthop above that internally uses the loopback netdev as its nexthop device. One way to fix this problem is to have listeners flush their nexthop tables after unregistering from the notification chain. This is error-prone as evident by this patch and also not symmetric with the registration path where a listener receives a dump of all the existing nexthops. Therefore, fix this problem by replaying delete notifications for the listener being unregistered. This is symmetric to the registration path and also consistent with the netdev notification chain. The above means that unregister_nexthop_notifier(), like register_nexthop_notifier(), will have to take RTNL in order to iterate over the existing nexthops and that any callers of the function cannot hold RTNL. This is true for mlxsw and netdevsim, but not for the VXLAN driver. To avoid a deadlock, change the latter to unregister its nexthop listener without holding RTNL, making it symmetric to the registration path. [1] unreferenced object 0xffff88806173d600 (size 512): comm "syz-executor.0", pid 1290, jiffies 4295583142 (age 143.507s) hex dump (first 32 bytes): 41 9d 1e 60 80 88 ff ff 08 d6 73 61 80 88 ff ff A..`......sa.... 08 d6 73 61 80 88 ff ff 01 00 00 00 00 00 00 00 ..sa............ backtrace: [<ffffffff81a6b576>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<ffffffff81a6b576>] slab_post_alloc_hook+0x96/0x490 mm/slab.h:522 [<ffffffff81a716d3>] slab_alloc_node mm/slub.c:3206 [inline] [<ffffffff81a716d3>] slab_alloc mm/slub.c:3214 [inline] [<ffffffff81a716d3>] kmem_cache_alloc_trace+0x163/0x370 mm/slub.c:3231 [<ffffffff82e8681a>] kmalloc include/linux/slab.h:591 [inline] [<ffffffff82e8681a>] kzalloc include/linux/slab.h:721 [inline] [<ffffffff82e8681a>] mlxsw_sp_nexthop_obj_group_create drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:4918 [inline] [<ffffffff82e8681a>] mlxsw_sp_nexthop_obj_new drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5054 [inline] [<ffffffff82e8681a>] mlxsw_sp_nexthop_obj_event+0x59a/0x2910 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5239 [<ffffffff813ef67d>] notifier_call_chain+0xbd/0x210 kernel/notifier.c:83 [<ffffffff813f0662>] blocking_notifier_call_chain kernel/notifier.c:318 [inline] [<ffffffff813f0662>] blocking_notifier_call_chain+0x72/0xa0 kernel/notifier.c:306 [<ffffffff8384b9c6>] call_nexthop_notifiers+0x156/0x310 net/ipv4/nexthop.c:244 [<ffffffff83852bd8>] insert_nexthop net/ipv4/nexthop.c:2336 [inline] [<ffffffff83852bd8>] nexthop_add net/ipv4/nexthop.c:2644 [inline] [<ffffffff83852bd8>] rtm_new_nexthop+0x14e8/0x4d10 net/ipv4/nexthop.c:2913 [<ffffffff833e9a78>] rtnetlink_rcv_msg+0x448/0xbf0 net/core/rtnetlink.c:5572 [<ffffffff83608703>] netlink_rcv_skb+0x173/0x480 net/netlink/af_netlink.c:2504 [<ffffffff833de032>] rtnetlink_rcv+0x22/0x30 net/core/rtnetlink.c:5590 [<ffffffff836069de>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] [<ffffffff836069de>] netlink_unicast+0x5ae/0x7f0 net/netlink/af_netlink.c:1340 [<ffffffff83607501>] netlink_sendmsg+0x8e1/0xe30 net/netlink/af_netlink.c:1929 [<ffffffff832fde84>] sock_sendmsg_nosec net/socket.c:704 [inline ---truncated---
Severity ?
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE
  • CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2a014b200bbd973cc96e082a5bc445fe20b50f32 , < 741760fa6252628a3d3afad439b72437d4b123d9 (git)
Affected: 2a014b200bbd973cc96e082a5bc445fe20b50f32 , < 3106a0847525befe3e22fc723909d1b21eb0d520 (git)
Create a notification for this product.
    Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.14.9 , ≤ 5.14.* (semver)
Unaffected: 5.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "5.15"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "741760fa6252",
                "status": "affected",
                "version": "2a014b200bbd",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "3106a0847525",
                "status": "affected",
                "version": "2a014b200bbd",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.11"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5.11",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.14.*",
                "status": "unaffected",
                "version": "5.14.9",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T19:31:31.423826Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T19:31:36.050Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.624Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/741760fa6252628a3d3afad439b72437d4b123d9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3106a0847525befe3e22fc723909d1b21eb0d520"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan.c",
            "net/ipv4/nexthop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "741760fa6252628a3d3afad439b72437d4b123d9",
              "status": "affected",
              "version": "2a014b200bbd973cc96e082a5bc445fe20b50f32",
              "versionType": "git"
            },
            {
              "lessThan": "3106a0847525befe3e22fc723909d1b21eb0d520",
              "status": "affected",
              "version": "2a014b200bbd973cc96e082a5bc445fe20b50f32",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan.c",
            "net/ipv4/nexthop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.9",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Fix memory leaks in nexthop notification chain listeners\n\nsyzkaller discovered memory leaks [1] that can be reduced to the\nfollowing commands:\n\n # ip nexthop add id 1 blackhole\n # devlink dev reload pci/0000:06:00.0\n\nAs part of the reload flow, mlxsw will unregister its netdevs and then\nunregister from the nexthop notification chain. Before unregistering\nfrom the notification chain, mlxsw will receive delete notifications for\nnexthop objects using netdevs registered by mlxsw or their uppers. mlxsw\nwill not receive notifications for nexthops using netdevs that are not\ndismantled as part of the reload flow. For example, the blackhole\nnexthop above that internally uses the loopback netdev as its nexthop\ndevice.\n\nOne way to fix this problem is to have listeners flush their nexthop\ntables after unregistering from the notification chain. This is\nerror-prone as evident by this patch and also not symmetric with the\nregistration path where a listener receives a dump of all the existing\nnexthops.\n\nTherefore, fix this problem by replaying delete notifications for the\nlistener being unregistered. This is symmetric to the registration path\nand also consistent with the netdev notification chain.\n\nThe above means that unregister_nexthop_notifier(), like\nregister_nexthop_notifier(), will have to take RTNL in order to iterate\nover the existing nexthops and that any callers of the function cannot\nhold RTNL. This is true for mlxsw and netdevsim, but not for the VXLAN\ndriver. To avoid a deadlock, change the latter to unregister its nexthop\nlistener without holding RTNL, making it symmetric to the registration\npath.\n\n[1]\nunreferenced object 0xffff88806173d600 (size 512):\n  comm \"syz-executor.0\", pid 1290, jiffies 4295583142 (age 143.507s)\n  hex dump (first 32 bytes):\n    41 9d 1e 60 80 88 ff ff 08 d6 73 61 80 88 ff ff  A..`......sa....\n    08 d6 73 61 80 88 ff ff 01 00 00 00 00 00 00 00  ..sa............\n  backtrace:\n    [\u003cffffffff81a6b576\u003e] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]\n    [\u003cffffffff81a6b576\u003e] slab_post_alloc_hook+0x96/0x490 mm/slab.h:522\n    [\u003cffffffff81a716d3\u003e] slab_alloc_node mm/slub.c:3206 [inline]\n    [\u003cffffffff81a716d3\u003e] slab_alloc mm/slub.c:3214 [inline]\n    [\u003cffffffff81a716d3\u003e] kmem_cache_alloc_trace+0x163/0x370 mm/slub.c:3231\n    [\u003cffffffff82e8681a\u003e] kmalloc include/linux/slab.h:591 [inline]\n    [\u003cffffffff82e8681a\u003e] kzalloc include/linux/slab.h:721 [inline]\n    [\u003cffffffff82e8681a\u003e] mlxsw_sp_nexthop_obj_group_create drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:4918 [inline]\n    [\u003cffffffff82e8681a\u003e] mlxsw_sp_nexthop_obj_new drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5054 [inline]\n    [\u003cffffffff82e8681a\u003e] mlxsw_sp_nexthop_obj_event+0x59a/0x2910 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5239\n    [\u003cffffffff813ef67d\u003e] notifier_call_chain+0xbd/0x210 kernel/notifier.c:83\n    [\u003cffffffff813f0662\u003e] blocking_notifier_call_chain kernel/notifier.c:318 [inline]\n    [\u003cffffffff813f0662\u003e] blocking_notifier_call_chain+0x72/0xa0 kernel/notifier.c:306\n    [\u003cffffffff8384b9c6\u003e] call_nexthop_notifiers+0x156/0x310 net/ipv4/nexthop.c:244\n    [\u003cffffffff83852bd8\u003e] insert_nexthop net/ipv4/nexthop.c:2336 [inline]\n    [\u003cffffffff83852bd8\u003e] nexthop_add net/ipv4/nexthop.c:2644 [inline]\n    [\u003cffffffff83852bd8\u003e] rtm_new_nexthop+0x14e8/0x4d10 net/ipv4/nexthop.c:2913\n    [\u003cffffffff833e9a78\u003e] rtnetlink_rcv_msg+0x448/0xbf0 net/core/rtnetlink.c:5572\n    [\u003cffffffff83608703\u003e] netlink_rcv_skb+0x173/0x480 net/netlink/af_netlink.c:2504\n    [\u003cffffffff833de032\u003e] rtnetlink_rcv+0x22/0x30 net/core/rtnetlink.c:5590\n    [\u003cffffffff836069de\u003e] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\n    [\u003cffffffff836069de\u003e] netlink_unicast+0x5ae/0x7f0 net/netlink/af_netlink.c:1340\n    [\u003cffffffff83607501\u003e] netlink_sendmsg+0x8e1/0xe30 net/netlink/af_netlink.c:1929\n    [\u003cffffffff832fde84\u003e] sock_sendmsg_nosec net/socket.c:704 [inline\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:09:33.941Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/741760fa6252628a3d3afad439b72437d4b123d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3106a0847525befe3e22fc723909d1b21eb0d520"
        }
      ],
      "title": "nexthop: Fix memory leaks in nexthop notification chain listeners",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47371",
    "datePublished": "2024-05-21T15:03:36.467Z",
    "dateReserved": "2024-05-21T14:58:30.810Z",
    "dateUpdated": "2025-05-04T07:09:33.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/741760fa6252628a3d3afad439b72437d4b123d9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3106a0847525befe3e22fc723909d1b21eb0d520\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.624Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47371\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-05T19:31:31.423826Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.15\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"2a014b200bbd\", \"lessThan\": \"741760fa6252\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"2a014b200bbd\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3106a0847525\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.14.9\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.14.*\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-05T19:24:59.850Z\"}}], \"cna\": {\"title\": \"nexthop: Fix memory leaks in nexthop notification chain listeners\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2a014b200bbd973cc96e082a5bc445fe20b50f32\", \"lessThan\": \"741760fa6252628a3d3afad439b72437d4b123d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2a014b200bbd973cc96e082a5bc445fe20b50f32\", \"lessThan\": \"3106a0847525befe3e22fc723909d1b21eb0d520\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/vxlan.c\", \"net/ipv4/nexthop.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.14.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/vxlan.c\", \"net/ipv4/nexthop.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/741760fa6252628a3d3afad439b72437d4b123d9\"}, {\"url\": \"https://git.kernel.org/stable/c/3106a0847525befe3e22fc723909d1b21eb0d520\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnexthop: Fix memory leaks in nexthop notification chain listeners\\n\\nsyzkaller discovered memory leaks [1] that can be reduced to the\\nfollowing commands:\\n\\n # ip nexthop add id 1 blackhole\\n # devlink dev reload pci/0000:06:00.0\\n\\nAs part of the reload flow, mlxsw will unregister its netdevs and then\\nunregister from the nexthop notification chain. Before unregistering\\nfrom the notification chain, mlxsw will receive delete notifications for\\nnexthop objects using netdevs registered by mlxsw or their uppers. mlxsw\\nwill not receive notifications for nexthops using netdevs that are not\\ndismantled as part of the reload flow. For example, the blackhole\\nnexthop above that internally uses the loopback netdev as its nexthop\\ndevice.\\n\\nOne way to fix this problem is to have listeners flush their nexthop\\ntables after unregistering from the notification chain. This is\\nerror-prone as evident by this patch and also not symmetric with the\\nregistration path where a listener receives a dump of all the existing\\nnexthops.\\n\\nTherefore, fix this problem by replaying delete notifications for the\\nlistener being unregistered. This is symmetric to the registration path\\nand also consistent with the netdev notification chain.\\n\\nThe above means that unregister_nexthop_notifier(), like\\nregister_nexthop_notifier(), will have to take RTNL in order to iterate\\nover the existing nexthops and that any callers of the function cannot\\nhold RTNL. This is true for mlxsw and netdevsim, but not for the VXLAN\\ndriver. To avoid a deadlock, change the latter to unregister its nexthop\\nlistener without holding RTNL, making it symmetric to the registration\\npath.\\n\\n[1]\\nunreferenced object 0xffff88806173d600 (size 512):\\n  comm \\\"syz-executor.0\\\", pid 1290, jiffies 4295583142 (age 143.507s)\\n  hex dump (first 32 bytes):\\n    41 9d 1e 60 80 88 ff ff 08 d6 73 61 80 88 ff ff  A..`......sa....\\n    08 d6 73 61 80 88 ff ff 01 00 00 00 00 00 00 00  ..sa............\\n  backtrace:\\n    [\u003cffffffff81a6b576\u003e] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]\\n    [\u003cffffffff81a6b576\u003e] slab_post_alloc_hook+0x96/0x490 mm/slab.h:522\\n    [\u003cffffffff81a716d3\u003e] slab_alloc_node mm/slub.c:3206 [inline]\\n    [\u003cffffffff81a716d3\u003e] slab_alloc mm/slub.c:3214 [inline]\\n    [\u003cffffffff81a716d3\u003e] kmem_cache_alloc_trace+0x163/0x370 mm/slub.c:3231\\n    [\u003cffffffff82e8681a\u003e] kmalloc include/linux/slab.h:591 [inline]\\n    [\u003cffffffff82e8681a\u003e] kzalloc include/linux/slab.h:721 [inline]\\n    [\u003cffffffff82e8681a\u003e] mlxsw_sp_nexthop_obj_group_create drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:4918 [inline]\\n    [\u003cffffffff82e8681a\u003e] mlxsw_sp_nexthop_obj_new drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5054 [inline]\\n    [\u003cffffffff82e8681a\u003e] mlxsw_sp_nexthop_obj_event+0x59a/0x2910 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5239\\n    [\u003cffffffff813ef67d\u003e] notifier_call_chain+0xbd/0x210 kernel/notifier.c:83\\n    [\u003cffffffff813f0662\u003e] blocking_notifier_call_chain kernel/notifier.c:318 [inline]\\n    [\u003cffffffff813f0662\u003e] blocking_notifier_call_chain+0x72/0xa0 kernel/notifier.c:306\\n    [\u003cffffffff8384b9c6\u003e] call_nexthop_notifiers+0x156/0x310 net/ipv4/nexthop.c:244\\n    [\u003cffffffff83852bd8\u003e] insert_nexthop net/ipv4/nexthop.c:2336 [inline]\\n    [\u003cffffffff83852bd8\u003e] nexthop_add net/ipv4/nexthop.c:2644 [inline]\\n    [\u003cffffffff83852bd8\u003e] rtm_new_nexthop+0x14e8/0x4d10 net/ipv4/nexthop.c:2913\\n    [\u003cffffffff833e9a78\u003e] rtnetlink_rcv_msg+0x448/0xbf0 net/core/rtnetlink.c:5572\\n    [\u003cffffffff83608703\u003e] netlink_rcv_skb+0x173/0x480 net/netlink/af_netlink.c:2504\\n    [\u003cffffffff833de032\u003e] rtnetlink_rcv+0x22/0x30 net/core/rtnetlink.c:5590\\n    [\u003cffffffff836069de\u003e] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\\n    [\u003cffffffff836069de\u003e] netlink_unicast+0x5ae/0x7f0 net/netlink/af_netlink.c:1340\\n    [\u003cffffffff83607501\u003e] netlink_sendmsg+0x8e1/0xe30 net/netlink/af_netlink.c:1929\\n    [\u003cffffffff832fde84\u003e] sock_sendmsg_nosec net/socket.c:704 [inline\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.9\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"5.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:09:33.941Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47371\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:09:33.941Z\", \"dateReserved\": \"2024-05-21T14:58:30.810Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:03:36.467Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.