CVE-2021-47291
Description
From CVE.org
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions While running the self-tests on a KASAN enabled kernel, I observed a slab-out-of-bounds splat very similar to the one reported in commit 821bbf79fe46 ("ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions"). We additionally need to take care of fib6_metrics initialization failure when the caller provides an nh. The fix is similar, explicitly free the route instead of calling fib6_info_release on a half-initialized object.
Statement
A low severity out-of-bounds read flaw was found in the Linux kernel's IPv6 routing subsystem (net/ipv6/route.c). When an IPv6 route is created with a caller-provided nexthop and the initialization of fib6_metrics fails, the error-handling path in fib6_nh_flush_exceptions calls fib6_info_release on a half-initialized fib6_info object, causing a slab-out-of-bounds read, as observed with KASAN-enabled kernels during self-tests. Triggering this issue requires local privileged access, namely the ability to configure IPv6 routes combined with a fib6_metrics initialization failure, and the realistic consequence is a kernel crash and resulting denial of service. Red Hat therefore rates this flaw LOW impact with CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting availability impact only; the higher NIST (7.1) and CVE.org (7.8) scores additionally assume confidentiality and integrity impacts that Red Hat does not consider established for this out-of-bounds read.
The vulnerable code was introduced upstream in Linux v5.3 and is fixed in upstream kernel releases. Red Hat's current records show the supported Red Hat Enterprise Linux 8 update streams, the kernels used in Hosted OpenShift (ARO and OSD), and Fedora as not affected, while the RHEL 9 kernel and kernel-rt records were delegated to the kernel team, which resolved them as not affected. The Red Hat Enterprise Linux 7 and 6 Extended Life Cycle Support streams are out of support scope for this flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 7.1 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | High | High |
| Integrity Impact | None | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
