CVE-2021-47137

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47137", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-04T18:12:48.841Z", "datePublished": "2024-03-25T09:07:36.778Z", "dateUpdated": "2026-08-05T08:46:17.530Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:17.530Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lantiq: fix memory corruption in RX ring\n\nIn a situation where memory allocation or dma mapping fails, an\ninvalid address is programmed into the descriptor. This can lead\nto memory corruption. If the memory allocation fails, DMA should\nreuse the previous skb and mapping and drop the packet. This patch\nalso increments rx drop counter."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is reached from the XRX200 PMAC receive path (DMA IRQ \u2192 NAPI \u2192 xrx200_poll_rx \u2192 xrx200_hw_receive \u2192 xrx200_alloc_skb) while processing inbound frames; on typical VRX200 gateway deployments this CPU port handles WAN/LAN switch traffic, so a remote peer can trigger it by sending packets.\nAC:L - An attacker can flood traffic to induce memory pressure on constrained VRX200 routers so netdev_alloc_skb or dma_map_single fails during RX refill; once that happens the invalid-descriptor/UAF or NULL-deref path is deterministic, and under the uncertainty rule allocation/mapping failure is treated as low complexity.\nPR:N - No local account or capability is required; any host that can deliver frames to the interface causes RX ring refill with no authentication gate on this path.\nUI:N - Exploitation requires only attacker-sent packets; no victim action such as mounting a filesystem or opening a device is needed.\nS:U - Corruption and crashes occur in the host kernel\u2019s ethernet driver/DMA path within the same security authority; this is not a VM escape or IOMMU/sandbox boundary crossing.\nC:H - On DMA mapping failure the driver programs DMA_MAPPING_ERROR into the RX descriptor and frees the new skb while leaving a dangling ring pointer, yielding a use-after-free plus DMA of attacker-controlled packet bytes to an invalid address\u2014memory corruption that can be leveraged for kernel information disclosure.\nI:H - Programming an invalid RX DMA address lets hardware write attacker-controlled frame contents into unintended memory, and the dangling freed skb pointer is a classic UAF write/control-flow primitive under kernel memory-corruption guidance.\nA:H - Failed refill leaves a NULL or dangling skb in the RX ring so a subsequent packet causes NULL deref/UAF oops, and invalid DMA addresses can bus-error or panic the kernel, fully denying availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/lantiq_xrx200.c"], "versions": [{"version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "lessThan": "8bb1077448d43a871ed667520763e3b9f9b7975d", "status": "affected", "versionType": "git"}, {"version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "lessThan": "5ac72351655f8b033a2935646f53b7465c903418", "status": "affected", "versionType": "git"}, {"version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "lessThan": "46dd4abced3cb2c912916f4a5353e0927db0c4a2", "status": "affected", "versionType": "git"}, {"version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "lessThan": "c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/lantiq_xrx200.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.124", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.42", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.9", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.4.124"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.12.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d"}, {"url": "https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418"}, {"url": "https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2"}, {"url": "https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20"}], "title": "net: lantiq: fix memory corruption in RX ring", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-770", "lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "fe1a56420cf2", "status": "affected", "lessThan": "8bb1077448d4", "versionType": "git"}, {"version": "fe1a56420cf2", "status": "affected", "lessThan": "5ac72351655f", "versionType": "git"}, {"version": "fe1a56420cf2", "status": "affected", "lessThan": "46dd4abced3c", "versionType": "git"}, {"version": "fe1a56420cf2", "status": "affected", "lessThan": "c7718ee96dbc", "versionType": "git"}, {"version": "4.20", "status": "affected"}, {"version": "0", "status": "affected", "lessThanOrEqual": "4.20", "versionType": "semver"}, {"version": "5.4.124", "status": "affected", "lessThanOrEqual": "5.4*", "versionType": "semver"}, {"version": "5.10.42", "status": "affected", "lessThanOrEqual": "5.10*", "versionType": "semver"}, {"version": "5.12.9", "status": "affected", "lessThanOrEqual": "5.12*", "versionType": "semver"}, {"version": "5.13", "status": "affected", "lessThanOrEqual": "*", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-03-25T17:15:32.931685Z", "id": "CVE-2021-47137", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-05T16:22:44.933Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.977Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.977Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-47137", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-25T17:15:32.931685Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "fe1a56420cf2", "lessThan": "8bb1077448d4", "versionType": "git"}, {"status": "affected", "version": "fe1a56420cf2", "lessThan": "5ac72351655f", "versionType": "git"}, {"status": "affected", "version": "fe1a56420cf2", "lessThan": "46dd4abced3c", "versionType": "git"}, {"status": "affected", "version": "fe1a56420cf2", "lessThan": "c7718ee96dbc", "versionType": "git"}, {"status": "affected", "version": "4.20"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.20"}, {"status": "affected", "version": "5.4.124", "versionType": "semver", "lessThanOrEqual": "5.4*"}, {"status": "affected", "version": "5.10.42", "versionType": "semver", "lessThanOrEqual": "5.10*"}, {"status": "affected", "version": "5.12.9", "versionType": "semver", "lessThanOrEqual": "5.12*"}, {"status": "affected", "version": "5.13", "versionType": "semver", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:19.437Z"}}], "cna": {"title": "net: lantiq: fix memory corruption in RX ring", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is reached from the XRX200 PMAC receive path (DMA IRQ \u2192 NAPI \u2192 xrx200_poll_rx \u2192 xrx200_hw_receive \u2192 xrx200_alloc_skb) while processing inbound frames; on typical VRX200 gateway deployments this CPU port handles WAN/LAN switch traffic, so a remote peer can trigger it by sending packets.\nAC:L - An attacker can flood traffic to induce memory pressure on constrained VRX200 routers so netdev_alloc_skb or dma_map_single fails during RX refill; once that happens the invalid-descriptor/UAF or NULL-deref path is deterministic, and under the uncertainty rule allocation/mapping failure is treated as low complexity.\nPR:N - No local account or capability is required; any host that can deliver frames to the interface causes RX ring refill with no authentication gate on this path.\nUI:N - Exploitation requires only attacker-sent packets; no victim action such as mounting a filesystem or opening a device is needed.\nS:U - Corruption and crashes occur in the host kernel\u2019s ethernet driver/DMA path within the same security authority; this is not a VM escape or IOMMU/sandbox boundary crossing.\nC:H - On DMA mapping failure the driver programs DMA_MAPPING_ERROR into the RX descriptor and frees the new skb while leaving a dangling ring pointer, yielding a use-after-free plus DMA of attacker-controlled packet bytes to an invalid address\u2014memory corruption that can be leveraged for kernel information disclosure.\nI:H - Programming an invalid RX DMA address lets hardware write attacker-controlled frame contents into unintended memory, and the dangling freed skb pointer is a classic UAF write/control-flow primitive under kernel memory-corruption guidance.\nA:H - Failed refill leaves a NULL or dangling skb in the RX ring so a subsequent packet causes NULL deref/UAF oops, and invalid DMA addresses can bus-error or panic the kernel, fully denying availability."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "lessThan": "8bb1077448d43a871ed667520763e3b9f9b7975d", "versionType": "git"}, {"status": "affected", "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "lessThan": "5ac72351655f8b033a2935646f53b7465c903418", "versionType": "git"}, {"status": "affected", "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "lessThan": "46dd4abced3cb2c912916f4a5353e0927db0c4a2", "versionType": "git"}, {"status": "affected", "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "lessThan": "c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/lantiq_xrx200.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"status": "unaffected", "version": "0", "lessThan": "4.20", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.124", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.42", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.12.9", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/lantiq_xrx200.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d"}, {"url": "https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418"}, {"url": "https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2"}, {"url": "https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lantiq: fix memory corruption in RX ring\n\nIn a situation where memory allocation or dma mapping fails, an\ninvalid address is programmed into the descriptor. This can lead\nto memory corruption. If the memory allocation fails, DMA should\nreuse the previous skb and mapping and drop the packet. This patch\nalso increments rx drop counter."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.124", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.42", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.12.9", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.13", "versionStartIncluding": "4.20"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:17.530Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47137", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:46:17.530Z", "dateReserved": "2024-03-04T18:12:48.841Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-25T09:07:36.778Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/lantiq_xrx200.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8bb1077448d43a871ed667520763e3b9f9b7975d", "status": "affected", "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "versionType": "git"}, {"lessThan": "5ac72351655f8b033a2935646f53b7465c903418", "status": "affected", "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "versionType": "git"}, {"lessThan": "46dd4abced3cb2c912916f4a5353e0927db0c4a2", "status": "affected", "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "versionType": "git"}, {"lessThan": "c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20", "status": "affected", "version": "fe1a56420cf2ec28c8eceef672b87de0bbe1a260", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/lantiq_xrx200.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.124", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.42", "versionType": "semver"}, {"lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "8bb1077448d4", "status": "affected", "version": "fe1a56420cf2", "versionType": "git"}, {"lessThan": "5ac72351655f", "status": "affected", "version": "fe1a56420cf2", "versionType": "git"}, {"lessThan": "46dd4abced3c", "status": "affected", "version": "fe1a56420cf2", "versionType": "git"}, {"lessThan": "c7718ee96dbc", "status": "affected", "version": "fe1a56420cf2", "versionType": "git"}, {"status": "affected", "version": "4.20"}, {"lessThanOrEqual": "4.20", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4*", "status": "affected", "version": "5.4.124", "versionType": "semver"}, {"lessThanOrEqual": "5.10*", "status": "affected", "version": "5.10.42", "versionType": "semver"}, {"lessThanOrEqual": "5.12*", "status": "affected", "version": "5.12.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "affected", "version": "5.13", "versionType": "semver"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "06FE0F99-F7A9-462A-8355-30E2EDA9826B", "versionEndExcluding": "5.4.124", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3E7E799-1C8A-45FB-9E07-4731996144C9", "versionEndExcluding": "5.10.42", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C8A1D02-81A7-44E5-ACFD-CC6A6694F930", "versionEndExcluding": "5.12.9", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*", "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lantiq: fix memory corruption in RX ring\n\nIn a situation where memory allocation or dma mapping fails, an\ninvalid address is programmed into the descriptor. This can lead\nto memory corruption. If the memory allocation fails, DMA should\nreuse the previous skb and mapping and drop the packet. This patch\nalso increments rx drop counter."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net: lantiq: corrige la corrupci\u00f3n de la memoria en el anillo RX En una situaci\u00f3n en la que falla la asignaci\u00f3n de memoria o el mapeo dma, se programa una direcci\u00f3n no v\u00e1lida en el descriptor. Esto puede provocar da\u00f1os en la memoria. Si la asignaci\u00f3n de memoria falla, DMA deber\u00eda reutilizar el skb y el mapeo anteriores y descartar el paquete. Este parche tambi\u00e9n incrementa el contador de ca\u00eddas de rx."}], "id": "CVE-2021-47137", "lastModified": "2026-08-04T10:16:48.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47137", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-03-25T17:15:32.931685Z", "version": "2.0.3"}}]}, "published": "2024-03-25T09:15:08.240", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net: lantiq: fix memory corruption in RX ring", "id": "2271499", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271499"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: lantiq: fix memory corruption in RX ring\nIn a situation where memory allocation or dma mapping fails, an\ninvalid address is programmed into the descriptor. This can lead\nto memory corruption. If the memory allocation fails, DMA should\nreuse the previous skb and mapping and drop the packet. This patch\nalso increments rx drop counter."], "name": "CVE-2021-47137", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47137\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47137\nhttps://lore.kernel.org/linux-cve-announce/2024032556-CVE-2021-47137-7c8e@gregkh/T"], "threat_severity": "Low"}

{}