CVE-2021-47148

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47148", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-04T18:12:48.845Z", "datePublished": "2024-03-25T09:07:44.472Z", "dateUpdated": "2026-08-05T08:46:19.658Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:19.658Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: fix a buffer overflow in otx2_set_rxfh_context()\n\nThis function is called from ethtool_set_rxfh() and \"*rss_context\"\ncomes from the user. Add some bounds checking to prevent memory\ncorruption."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached only through a local SIOCETHTOOL ioctl (ETHTOOL_SRSSH \u2192 ethtool_set_rxfh \u2192 otx2_set_rxfh_context); it is not triggered by received network packets or a remote service.\nAC:L - The attacker fully controls the rss_context u32 from userspace and can reliably pass an out-of-bounds value; no race or external conditions beyond the attacker's control are required to hit the overflow.\nPR:L - ETHTOOL_SRSSH requires CAP_NET_ADMIN via ns_capable(net->user_ns, CAP_NET_ADMIN), which is obtainable without real init-namespace root when an octeontx2 PF/VF is present in a userns-owned netns (common SR-IOV/container deployments), so privileges are Low under kernel CNA guidance.\nUI:N - No victim action is required; the attacker issues the ethtool ioctl directly once they have local access and the needed capability.\nS:U - The corruption occurs in the host/guest kernel driver and elevates impact only within that same kernel security authority; it is not a VM escape or IOMMU/DMA boundary bypass.\nC:H - A user-controlled index into rss_ctx[] performs an out-of-bounds pointer load and can be paired with write/free primitives, which per guidance for memory corruption is treated as enabling high confidentiality impact.\nI:H - With an OOB context the code writes attacker-influenced indir bytes through the fetched pointer and can kfree an OOB pointer on delete, giving classic out-of-bounds write / arbitrary-free integrity compromise.\nA:H - Invalid pointer dereference or free from the out-of-bounds rss_ctx access can oops/panic the kernel, so availability impact is High."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c"], "versions": [{"version": "81a4362016e7d8b17031fe1aa43cdb58a7f0f163", "lessThan": "389146bc6d2bbb20714d06624b74856320ce40f7", "status": "affected", "versionType": "git"}, {"version": "81a4362016e7d8b17031fe1aa43cdb58a7f0f163", "lessThan": "e5cc361e21648b75f935f9571d4003aaee480214", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.9", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.12.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/389146bc6d2bbb20714d06624b74856320ce40f7"}, {"url": "https://git.kernel.org/stable/c/e5cc361e21648b75f935f9571d4003aaee480214"}], "title": "octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-26T20:36:23.128673Z", "id": "CVE-2021-47148", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-26T20:36:29.271Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:40.199Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/389146bc6d2bbb20714d06624b74856320ce40f7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e5cc361e21648b75f935f9571d4003aaee480214", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/389146bc6d2bbb20714d06624b74856320ce40f7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e5cc361e21648b75f935f9571d4003aaee480214", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:40.199Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-26T20:36:23.128673Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-26T20:36:26.803Z"}}], "cna": {"title": "octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached only through a local SIOCETHTOOL ioctl (ETHTOOL_SRSSH \u2192 ethtool_set_rxfh \u2192 otx2_set_rxfh_context); it is not triggered by received network packets or a remote service.\nAC:L - The attacker fully controls the rss_context u32 from userspace and can reliably pass an out-of-bounds value; no race or external conditions beyond the attacker's control are required to hit the overflow.\nPR:L - ETHTOOL_SRSSH requires CAP_NET_ADMIN via ns_capable(net->user_ns, CAP_NET_ADMIN), which is obtainable without real init-namespace root when an octeontx2 PF/VF is present in a userns-owned netns (common SR-IOV/container deployments), so privileges are Low under kernel CNA guidance.\nUI:N - No victim action is required; the attacker issues the ethtool ioctl directly once they have local access and the needed capability.\nS:U - The corruption occurs in the host/guest kernel driver and elevates impact only within that same kernel security authority; it is not a VM escape or IOMMU/DMA boundary bypass.\nC:H - A user-controlled index into rss_ctx[] performs an out-of-bounds pointer load and can be paired with write/free primitives, which per guidance for memory corruption is treated as enabling high confidentiality impact.\nI:H - With an OOB context the code writes attacker-influenced indir bytes through the fetched pointer and can kfree an OOB pointer on delete, giving classic out-of-bounds write / arbitrary-free integrity compromise.\nA:H - Invalid pointer dereference or free from the out-of-bounds rss_ctx access can oops/panic the kernel, so availability impact is High."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "81a4362016e7d8b17031fe1aa43cdb58a7f0f163", "lessThan": "389146bc6d2bbb20714d06624b74856320ce40f7", "versionType": "git"}, {"status": "affected", "version": "81a4362016e7d8b17031fe1aa43cdb58a7f0f163", "lessThan": "e5cc361e21648b75f935f9571d4003aaee480214", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"status": "unaffected", "version": "0", "lessThan": "5.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.12.9", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/389146bc6d2bbb20714d06624b74856320ce40f7"}, {"url": "https://git.kernel.org/stable/c/e5cc361e21648b75f935f9571d4003aaee480214"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: fix a buffer overflow in otx2_set_rxfh_context()\n\nThis function is called from ethtool_set_rxfh() and \"*rss_context\"\ncomes from the user. Add some bounds checking to prevent memory\ncorruption."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.12.9", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.13", "versionStartIncluding": "5.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:19.658Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47148", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:46:19.658Z", "dateReserved": "2024-03-04T18:12:48.845Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-25T09:07:44.472Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "389146bc6d2bbb20714d06624b74856320ce40f7", "status": "affected", "version": "81a4362016e7d8b17031fe1aa43cdb58a7f0f163", "versionType": "git"}, {"lessThan": "e5cc361e21648b75f935f9571d4003aaee480214", "status": "affected", "version": "81a4362016e7d8b17031fe1aa43cdb58a7f0f163", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B1CFA77-6B5E-430C-AC49-3B3508F2D903", "versionEndExcluding": "5.12.9", "versionStartIncluding": "5.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*", "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: fix a buffer overflow in otx2_set_rxfh_context()\n\nThis function is called from ethtool_set_rxfh() and \"*rss_context\"\ncomes from the user. Add some bounds checking to prevent memory\ncorruption."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: octeontx2-pf: corrige un desbordamiento del b\u00fafer en otx2_set_rxfh_context() Esta funci\u00f3n se llama desde ethtool_set_rxfh() y \"*rss_context\" proviene del usuario. Agregue algunas comprobaciones de los l\u00edmites para evitar da\u00f1os en la memoria."}], "id": "CVE-2021-47148", "lastModified": "2026-08-04T10:16:48.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47148", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-26T20:36:23.128673Z", "version": "2.0.3"}}]}, "published": "2024-03-25T09:15:09.150", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/389146bc6d2bbb20714d06624b74856320ce40f7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e5cc361e21648b75f935f9571d4003aaee480214"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/389146bc6d2bbb20714d06624b74856320ce40f7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e5cc361e21648b75f935f9571d4003aaee480214"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context()", "id": "2271495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271495"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-119", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nocteontx2-pf: fix a buffer overflow in otx2_set_rxfh_context()\nThis function is called from ethtool_set_rxfh() and \"*rss_context\"\ncomes from the user. Add some bounds checking to prevent memory\ncorruption.", "A vulnerability was found in octeontx2-pf driver of Linux Kernel, where a buffer overflow could occur due to insufficient bounds checking on the variable *rss_context. This could potentially lead to memory corruption. The issue has been addressed by implementing proper bounds checking to ensure that input size limits are respected, thereby preventing buffer overflows and enhancing system security within the octeontx2-pf driver."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2021-47148", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47148\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47148\nhttps://lore.kernel.org/linux-cve-announce/2024032559-CVE-2021-47148-502f@gregkh/T"], "threat_severity": "Moderate"}

{}