CVE-2021-47215

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47215", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-04-10T18:59:19.528Z", "datePublished": "2024-04-10T19:01:55.157Z", "dateUpdated": "2026-08-05T08:46:45.596Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:45.596Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: kTLS, Fix crash in RX resync flow\n\nFor the TLS RX resync flow, we maintain a list of TLS contexts\nthat require some attention, to communicate their resync information\nto the HW.\nHere we fix list corruptions, by protecting the entries against\nmovements coming from resync_handle_seq_match(), until their resync\nhandling in napi is fully completed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The buggy path is mlx5e kTLS RX resync (mlx5e_ktls_rx_resync \u2192 resync_handle_seq_match), invoked from the TLS stack when processing records from a remote peer after the NIC signals CQE_TLS_OFFLOAD_RESYNC; kTLS bugs driven by remote peer data are Network per guidance.\nAC:L - A remote peer can induce HW stream desync (reorder/loss/stream-scan) and then flood TLS records so multiple seq-match callbacks re-add the same priv_rx while it remains on the resync or NAPI local list; the attacker drives both the match callbacks and the RX/NAPI activity that opens the window.\nPR:N - Triggering requires only connecting as a TLS client to a service that has installed kTLS RX hardware offload on an mlx5 NIC; no local OS privileges or authenticated kernel credentials are needed.\nUI:N - The victim need only already be serving TLS with mlx5 kTLS RX offload; the attacker alone completes the handshake and drives the resync/race traffic with no further user action.\nS:U - List corruption stays within host kernel heap/list state for the mlx5e/TLS offload contexts and does not cross a VM, IOMMU, or other separate security authority.\nC:H - Double list_add of an in-list node corrupts neighboring list pointers and yields classic heap UAF when those links are later walked, which can be groomed for arbitrary kernel memory disclosure.\nI:H - Subsequent list_del/list_move/splice through the corrupted pointers write into attacker-influenced addresses, providing a heap corruption and control-flow hijack primitive beyond a mere crash.\nA:H - The fix explicitly addresses a crash from list corruption in the RX resync flow; corrupted list walks produce kernel oops/BUG (list_debug) that fully disrupt host availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c"], "versions": [{"version": "e9ce991bce5bacf71641bd0f72f4b7c589529f40", "lessThan": "ebeda7a9528ae690e6bf12791a868f0cca8391f2", "status": "affected", "versionType": "git"}, {"version": "e9ce991bce5bacf71641bd0f72f4b7c589529f40", "lessThan": "cc4a9cc03faa6d8db1a6954bb536f2c1e63bdff6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.5", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ebeda7a9528ae690e6bf12791a868f0cca8391f2"}, {"url": "https://git.kernel.org/stable/c/cc4a9cc03faa6d8db1a6954bb536f2c1e63bdff6"}], "title": "net/mlx5e: kTLS, Fix crash in RX resync flow", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:07.443Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ebeda7a9528ae690e6bf12791a868f0cca8391f2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cc4a9cc03faa6d8db1a6954bb536f2c1e63bdff6", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47215", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:49:52.131087Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:32:56.486Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ebeda7a9528ae690e6bf12791a868f0cca8391f2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cc4a9cc03faa6d8db1a6954bb536f2c1e63bdff6", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:07.443Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47215", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:49:52.131087Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:13.654Z"}}], "cna": {"title": "net/mlx5e: kTLS, Fix crash in RX resync flow", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The buggy path is mlx5e kTLS RX resync (mlx5e_ktls_rx_resync \u2192 resync_handle_seq_match), invoked from the TLS stack when processing records from a remote peer after the NIC signals CQE_TLS_OFFLOAD_RESYNC; kTLS bugs driven by remote peer data are Network per guidance.\nAC:L - A remote peer can induce HW stream desync (reorder/loss/stream-scan) and then flood TLS records so multiple seq-match callbacks re-add the same priv_rx while it remains on the resync or NAPI local list; the attacker drives both the match callbacks and the RX/NAPI activity that opens the window.\nPR:N - Triggering requires only connecting as a TLS client to a service that has installed kTLS RX hardware offload on an mlx5 NIC; no local OS privileges or authenticated kernel credentials are needed.\nUI:N - The victim need only already be serving TLS with mlx5 kTLS RX offload; the attacker alone completes the handshake and drives the resync/race traffic with no further user action.\nS:U - List corruption stays within host kernel heap/list state for the mlx5e/TLS offload contexts and does not cross a VM, IOMMU, or other separate security authority.\nC:H - Double list_add of an in-list node corrupts neighboring list pointers and yields classic heap UAF when those links are later walked, which can be groomed for arbitrary kernel memory disclosure.\nI:H - Subsequent list_del/list_move/splice through the corrupted pointers write into attacker-influenced addresses, providing a heap corruption and control-flow hijack primitive beyond a mere crash.\nA:H - The fix explicitly addresses a crash from list corruption in the RX resync flow; corrupted list walks produce kernel oops/BUG (list_debug) that fully disrupt host availability."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e9ce991bce5bacf71641bd0f72f4b7c589529f40", "lessThan": "ebeda7a9528ae690e6bf12791a868f0cca8391f2", "versionType": "git"}, {"status": "affected", "version": "e9ce991bce5bacf71641bd0f72f4b7c589529f40", "lessThan": "cc4a9cc03faa6d8db1a6954bb536f2c1e63bdff6", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.5", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ebeda7a9528ae690e6bf12791a868f0cca8391f2"}, {"url": "https://git.kernel.org/stable/c/cc4a9cc03faa6d8db1a6954bb536f2c1e63bdff6"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: kTLS, Fix crash in RX resync flow\n\nFor the TLS RX resync flow, we maintain a list of TLS contexts\nthat require some attention, to communicate their resync information\nto the HW.\nHere we fix list corruptions, by protecting the entries against\nmovements coming from resync_handle_seq_match(), until their resync\nhandling in napi is fully completed."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.5", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16", "versionStartIncluding": "5.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:45.596Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47215", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:46:45.596Z", "dateReserved": "2024-04-10T18:59:19.528Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-10T19:01:55.157Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ebeda7a9528ae690e6bf12791a868f0cca8391f2", "status": "affected", "version": "e9ce991bce5bacf71641bd0f72f4b7c589529f40", "versionType": "git"}, {"lessThan": "cc4a9cc03faa6d8db1a6954bb536f2c1e63bdff6", "status": "affected", "version": "e9ce991bce5bacf71641bd0f72f4b7c589529f40", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "172C15F0-CF2B-47F2-8931-3368DC97E4E2", "versionEndExcluding": "5.15.5", "versionStartIncluding": "5.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "357AA433-37E8-4323-BFB2-3038D6E4B414", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: kTLS, Fix crash in RX resync flow\n\nFor the TLS RX resync flow, we maintain a list of TLS contexts\nthat require some attention, to communicate their resync information\nto the HW.\nHere we fix list corruptions, by protecting the entries against\nmovements coming from resync_handle_seq_match(), until their resync\nhandling in napi is fully completed."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: kTLS, se corrige un fallo en el flujo de resincronizaci\u00f3n RX Para el flujo de resincronizaci\u00f3n RX de TLS, mantenemos una lista de contextos TLS que requieren cierta atenci\u00f3n para comunicar su informaci\u00f3n de resincronizaci\u00f3n al hardware. Aqu\u00ed corregimos las corrupciones de la lista al proteger las entradas contra los movimientos provenientes de resync_handle_seq_match(), hasta que se complete por completo su manejo de resincronizaci\u00f3n en napi."}], "id": "CVE-2021-47215", "lastModified": "2026-08-04T10:16:52.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47215", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:49:52.131087Z", "version": "2.0.3"}}]}, "published": "2024-04-10T19:15:48.727", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc4a9cc03faa6d8db1a6954bb536f2c1e63bdff6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ebeda7a9528ae690e6bf12791a868f0cca8391f2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc4a9cc03faa6d8db1a6954bb536f2c1e63bdff6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ebeda7a9528ae690e6bf12791a868f0cca8391f2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net/mlx5e: kTLS, Fix crash in RX resync flow", "id": "2274571", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274571"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/mlx5e: kTLS, Fix crash in RX resync flow\nFor the TLS RX resync flow, we maintain a list of TLS contexts\nthat require some attention, to communicate their resync information\nto the HW.\nHere we fix list corruptions, by protecting the entries against\nmovements coming from resync_handle_seq_match(), until their resync\nhandling in napi is fully completed."], "name": "CVE-2021-47215", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47215\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47215\nhttps://lore.kernel.org/linux-cve-announce/2024041005-CVE-2021-47215-2718@gregkh/T"], "threat_severity": "Low"}

{}