CVE-2021-47515 (GCVE-0-2021-47515)
Vulnerability from cvelistv5 – Published: 2024-05-24 15:09 – Updated: 2026-08-05 08:48
VLAI
EPSS
VEX
Title
seg6: fix the iif in the IPv6 socket control block
Summary
In the Linux kernel, the following vulnerability has been resolved:
seg6: fix the iif in the IPv6 socket control block
When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving
interface index into the IPv4 socket control block (v5.16-rc4,
net/ipv4/ip_input.c line 510):
IPCB(skb)->iif = skb->skb_iif;
If that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH
header, the seg6_do_srh_encap(...) performs the required encapsulation.
In this case, the seg6_do_srh_encap function clears the IPv6 socket control
block (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163):
memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
The memset(...) was introduced in commit ef489749aae5 ("ipv6: sr: clear
IP6CB(skb) on SRH ip4ip6 encapsulation") a long time ago (2019-01-29).
Since the IPv6 socket control block and the IPv4 socket control block share
the same memory area (skb->cb), the receiving interface index info is lost
(IP6CB(skb)->iif is set to zero).
As a side effect, that condition triggers a NULL pointer dereference if
commit 0857d6f8c759 ("ipv6: When forwarding count rx stats on the orig
netdev") is applied.
To fix that issue, we set the IP6CB(skb)->iif with the index of the
receiving interface once again.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:35 UTC
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
c630ec8bdadae9d557b1ceb9d6c06e149108a0d4 , < b16d412e5f79734033df04e97d7ea2f50a8e9fe3
(git)
Affected: 2f704348c93ff8119e642dae6a72327f90b82810 , < 6431e71093f3da586a00c6d931481ffb0dc2db0e (git) Affected: ef489749aae508e6f17886775c075f12ff919fb1 , < ef8804e47c0a44ae106ead1740408af5ea6c6ee9 (git) Affected: ef489749aae508e6f17886775c075f12ff919fb1 , < 666521b3852d2b2f52d570f9122b1e4b50d96831 (git) Affected: ef489749aae508e6f17886775c075f12ff919fb1 , < 98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1 (git) Affected: ef489749aae508e6f17886775c075f12ff919fb1 , < ae68d93354e5bf5191ee673982251864ea24dd5c (git) Affected: b71b7e0280f47b4ac633fbfd153423814ea87810 (git) Affected: 4.14.98 , < 4.14.258 (semver) Affected: 4.19.20 , < 4.19.221 (semver) Affected: 4.20.7 , < 4.21 (semver) |
guessed | |
| Linux | Linux |
Affected:
5.0
Unaffected: 0 , < 5.0 (semver) Unaffected: 4.14.258 , ≤ 4.14.* (semver) Unaffected: 4.19.221 , ≤ 4.19.* (semver) Unaffected: 5.4.165 , ≤ 5.4.* (semver) Unaffected: 5.10.85 , ≤ 5.10.* (semver) Unaffected: 5.15.8 , ≤ 5.15.* (semver) Unaffected: 5.16 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:39:59.755Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47515",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T15:35:33.340330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:32:52.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_iptunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b16d412e5f79734033df04e97d7ea2f50a8e9fe3",
"status": "affected",
"version": "c630ec8bdadae9d557b1ceb9d6c06e149108a0d4",
"versionType": "git"
},
{
"lessThan": "6431e71093f3da586a00c6d931481ffb0dc2db0e",
"status": "affected",
"version": "2f704348c93ff8119e642dae6a72327f90b82810",
"versionType": "git"
},
{
"lessThan": "ef8804e47c0a44ae106ead1740408af5ea6c6ee9",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"lessThan": "666521b3852d2b2f52d570f9122b1e4b50d96831",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"lessThan": "98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"lessThan": "ae68d93354e5bf5191ee673982251864ea24dd5c",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"status": "affected",
"version": "b71b7e0280f47b4ac633fbfd153423814ea87810",
"versionType": "git"
},
{
"lessThan": "4.14.258",
"status": "affected",
"version": "4.14.98",
"versionType": "semver"
},
{
"lessThan": "4.19.221",
"status": "affected",
"version": "4.19.20",
"versionType": "semver"
},
{
"lessThan": "4.21",
"status": "affected",
"version": "4.20.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_iptunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.85",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.258",
"versionStartIncluding": "4.14.98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.221",
"versionStartIncluding": "4.19.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.165",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.85",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.8",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.16",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.20.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: fix the iif in the IPv6 socket control block\n\nWhen an IPv4 packet is received, the ip_rcv_core(...) sets the receiving\ninterface index into the IPv4 socket control block (v5.16-rc4,\nnet/ipv4/ip_input.c line 510):\n\n IPCB(skb)-\u003eiif = skb-\u003eskb_iif;\n\nIf that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH\nheader, the seg6_do_srh_encap(...) performs the required encapsulation.\nIn this case, the seg6_do_srh_encap function clears the IPv6 socket control\nblock (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163):\n\n memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));\n\nThe memset(...) was introduced in commit ef489749aae5 (\"ipv6: sr: clear\nIP6CB(skb) on SRH ip4ip6 encapsulation\") a long time ago (2019-01-29).\n\nSince the IPv6 socket control block and the IPv4 socket control block share\nthe same memory area (skb-\u003ecb), the receiving interface index info is lost\n(IP6CB(skb)-\u003eiif is set to zero).\n\nAs a side effect, that condition triggers a NULL pointer dereference if\ncommit 0857d6f8c759 (\"ipv6: When forwarding count rx stats on the orig\nnetdev\") is applied.\n\nTo fix that issue, we set the IP6CB(skb)-\u003eiif with the index of the\nreceiving interface once again."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On an SRv6 PE/router with ip4ip6 encap routes, a remote IPv4 packet is received, encapsulated in seg6_do_srh_encap(), then forwarded via ip6_forward(), so the crash is reachable over the network without local access.\nAC:L - Once SRv6 encap for IPv4 is configured (the intended deployment for this code), any matching IPv4 packet reliably clears IP6CB(skb)-\u003eiif and hits the NULL dereference; no race or attacker-uncontrollable memory layout is required.\nPR:N - Triggering requires only sending unauthenticated IPv4 packets that match an already-configured SRv6 encap route; the attacker needs no account or capability on the target.\nUI:N - Packet processing runs entirely in the kernel receive/forward path with no victim user action beyond the router already having SRv6 encap configured.\nS:U - The NULL dereference oopses the same host kernel that performs forwarding and does not cross a VM, IOMMU, or other security-authority boundary.\nC:N - This is a pure NULL pointer dereference of idev in ip6_forward() after iif is cleared to zero, with no OOB read, UAF, or other information-disclosure primitive.\nI:N - The fault is a straight NULL dereference of idev-\u003ecnf.disable_policy with no write primitive, type confusion, or memory corruption that could alter kernel state or hijack control flow.\nA:H - Dereferencing the NULL inet6_dev pointer in ip6_forward() causes a kernel oops/panic and can be re-triggered at will by remote packets, taking down the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:48:12.387Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3"
},
{
"url": "https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e"
},
{
"url": "https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9"
},
{
"url": "https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831"
},
{
"url": "https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1"
},
{
"url": "https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c"
}
],
"title": "seg6: fix the iif in the IPv6 socket control block",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47515",
"datePublished": "2024-05-24T15:09:29.334Z",
"dateReserved": "2024-05-24T15:02:54.824Z",
"dateUpdated": "2026-08-05T08:48:12.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-47515",
"date": "2026-09-20",
"epss": "0.00746",
"percentile": "0.53313"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_iptunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b16d412e5f79734033df04e97d7ea2f50a8e9fe3",
"status": "affected",
"version": "c630ec8bdadae9d557b1ceb9d6c06e149108a0d4",
"versionType": "git"
},
{
"lessThan": "6431e71093f3da586a00c6d931481ffb0dc2db0e",
"status": "affected",
"version": "2f704348c93ff8119e642dae6a72327f90b82810",
"versionType": "git"
},
{
"lessThan": "ef8804e47c0a44ae106ead1740408af5ea6c6ee9",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"lessThan": "666521b3852d2b2f52d570f9122b1e4b50d96831",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"lessThan": "98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"lessThan": "ae68d93354e5bf5191ee673982251864ea24dd5c",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"status": "affected",
"version": "b71b7e0280f47b4ac633fbfd153423814ea87810",
"versionType": "git"
},
{
"lessThan": "4.14.258",
"status": "affected",
"version": "4.14.98",
"versionType": "semver"
},
{
"lessThan": "4.19.221",
"status": "affected",
"version": "4.19.20",
"versionType": "semver"
},
{
"lessThan": "4.21",
"status": "affected",
"version": "4.20.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_iptunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.85",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "72C9A7C8-757B-4EFB-AC4E-B383EFFEF45C",
"versionEndExcluding": "4.14.258",
"versionStartIncluding": "4.14.98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9F887262-DA38-45C9-BED5-4D65E50DB9C0",
"versionEndExcluding": "4.19.221",
"versionStartIncluding": "4.19.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "232F87BF-8F17-4BEB-80A0-49489CB86DDA",
"versionEndExcluding": "5.0",
"versionStartIncluding": "4.20.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A29CBCD8-CCB1-42FD-BFC8-FD77C4D2FD57",
"versionEndExcluding": "5.4.165",
"versionStartIncluding": "5.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D9668578-08F7-4694-A86F-FCE448387A79",
"versionEndExcluding": "5.10.85",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6664ACE2-F748-4AE5-B98B-58803B0B2C3E",
"versionEndExcluding": "5.15.8",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1D0FE595-0CFE-4491-808B-CEF691CE7B0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "FDF49B77-4688-4908-9239-89B729456D22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "77F342FB-3D7B-4EAE-BF8B-57B7B860BAFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "47D61679-6515-4E18-83C7-A71982CCD83C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "357AA433-37E8-4323-BFB2-3038D6E4B414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A73429BA-C2D9-4D0C-A75F-06A1CA8B3983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "F621B5E3-E99D-49E7-90B9-EC3B77C95383",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "F7BFDCAA-1650-49AA-8462-407DD593F94F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: fix the iif in the IPv6 socket control block\n\nWhen an IPv4 packet is received, the ip_rcv_core(...) sets the receiving\ninterface index into the IPv4 socket control block (v5.16-rc4,\nnet/ipv4/ip_input.c line 510):\n\n IPCB(skb)-\u003eiif = skb-\u003eskb_iif;\n\nIf that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH\nheader, the seg6_do_srh_encap(...) performs the required encapsulation.\nIn this case, the seg6_do_srh_encap function clears the IPv6 socket control\nblock (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163):\n\n memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));\n\nThe memset(...) was introduced in commit ef489749aae5 (\"ipv6: sr: clear\nIP6CB(skb) on SRH ip4ip6 encapsulation\") a long time ago (2019-01-29).\n\nSince the IPv6 socket control block and the IPv4 socket control block share\nthe same memory area (skb-\u003ecb), the receiving interface index info is lost\n(IP6CB(skb)-\u003eiif is set to zero).\n\nAs a side effect, that condition triggers a NULL pointer dereference if\ncommit 0857d6f8c759 (\"ipv6: When forwarding count rx stats on the orig\nnetdev\") is applied.\n\nTo fix that issue, we set the IP6CB(skb)-\u003eiif with the index of the\nreceiving interface once again."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: seg6: corrige el iif en el bloque de control del socket IPv6 Cuando se recibe un paquete IPv4, ip_rcv_core(...) establece el \u00edndice de la interfaz de recepci\u00f3n en el bloque de control del socket IPv4 (v5 .16-rc4, net/ipv4/ip_input.c l\u00ednea 510): IPCB(skb)-\u0026gt;iif = skb-\u0026gt;skb_iif; Si ese paquete IPv4 debe encapsularse en un encabezado IPv6+SRH externo, seg6_do_srh_encap(...) realiza la encapsulaci\u00f3n requerida. En este caso, la funci\u00f3n seg6_do_srh_encap borra el bloque de control del socket IPv6 (v5.16-rc4 net/ipv6/seg6_iptunnel.c l\u00ednea 163): memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); El memset(...) se introdujo en El commit ef489749aae5 (\"ipv6: sr: clear IP6CB(skb) en la encapsulaci\u00f3n SRH ip4ip6\") hace mucho tiempo (29 de enero de 2019). Dado que el bloque de control del socket IPv6 y el bloque de control del socket IPv4 comparten la misma \u00e1rea de memoria (skb-\u0026gt;cb), la informaci\u00f3n del \u00edndice de la interfaz de recepci\u00f3n se pierde (IP6CB(skb)-\u0026gt;iif se establece en cero). Como efecto secundario, esa condici\u00f3n desencadena una desreferencia del puntero NULL si se aplica el commit 0857d6f8c759 (\"ipv6: al reenviar estad\u00edsticas de recuento de rx en el netdev original\"). Para solucionar ese problema, configuramos IP6CB(skb)-\u0026gt;iif con el \u00edndice de la interfaz de recepci\u00f3n una vez m\u00e1s."
}
],
"id": "CVE-2021-47515",
"lastModified": "2026-08-04T10:17:06.950",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-47515",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T15:35:33.340330Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-05-24T15:15:12.937",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T19:57:02+00:00",
"cve": "CVE-2021-47515",
"id": "CVE-2021-47515",
"initial_release_date": "2021-01-01T00:00:00+00:00",
"product_status:known_affected": "106",
"product_status:known_not_affected": "92",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: seg6: fix the iif in the IPv6 socket control block",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47515.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:39:59.755Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47515",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T15:35:33.340330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T12:42:13.176Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_iptunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b16d412e5f79734033df04e97d7ea2f50a8e9fe3",
"status": "affected",
"version": "c630ec8bdadae9d557b1ceb9d6c06e149108a0d4",
"versionType": "git"
},
{
"lessThan": "6431e71093f3da586a00c6d931481ffb0dc2db0e",
"status": "affected",
"version": "2f704348c93ff8119e642dae6a72327f90b82810",
"versionType": "git"
},
{
"lessThan": "ef8804e47c0a44ae106ead1740408af5ea6c6ee9",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"lessThan": "666521b3852d2b2f52d570f9122b1e4b50d96831",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"lessThan": "98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"lessThan": "ae68d93354e5bf5191ee673982251864ea24dd5c",
"status": "affected",
"version": "ef489749aae508e6f17886775c075f12ff919fb1",
"versionType": "git"
},
{
"status": "affected",
"version": "b71b7e0280f47b4ac633fbfd153423814ea87810",
"versionType": "git"
},
{
"lessThan": "4.14.258",
"status": "affected",
"version": "4.14.98",
"versionType": "semver"
},
{
"lessThan": "4.19.221",
"status": "affected",
"version": "4.19.20",
"versionType": "semver"
},
{
"lessThan": "4.21",
"status": "affected",
"version": "4.20.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_iptunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.85",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.258",
"versionStartIncluding": "4.14.98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.221",
"versionStartIncluding": "4.19.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.165",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.85",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.8",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.16",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.20.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: fix the iif in the IPv6 socket control block\n\nWhen an IPv4 packet is received, the ip_rcv_core(...) sets the receiving\ninterface index into the IPv4 socket control block (v5.16-rc4,\nnet/ipv4/ip_input.c line 510):\n\n IPCB(skb)-\u003eiif = skb-\u003eskb_iif;\n\nIf that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH\nheader, the seg6_do_srh_encap(...) performs the required encapsulation.\nIn this case, the seg6_do_srh_encap function clears the IPv6 socket control\nblock (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163):\n\n memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));\n\nThe memset(...) was introduced in commit ef489749aae5 (\"ipv6: sr: clear\nIP6CB(skb) on SRH ip4ip6 encapsulation\") a long time ago (2019-01-29).\n\nSince the IPv6 socket control block and the IPv4 socket control block share\nthe same memory area (skb-\u003ecb), the receiving interface index info is lost\n(IP6CB(skb)-\u003eiif is set to zero).\n\nAs a side effect, that condition triggers a NULL pointer dereference if\ncommit 0857d6f8c759 (\"ipv6: When forwarding count rx stats on the orig\nnetdev\") is applied.\n\nTo fix that issue, we set the IP6CB(skb)-\u003eiif with the index of the\nreceiving interface once again."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On an SRv6 PE/router with ip4ip6 encap routes, a remote IPv4 packet is received, encapsulated in seg6_do_srh_encap(), then forwarded via ip6_forward(), so the crash is reachable over the network without local access.\nAC:L - Once SRv6 encap for IPv4 is configured (the intended deployment for this code), any matching IPv4 packet reliably clears IP6CB(skb)-\u003eiif and hits the NULL dereference; no race or attacker-uncontrollable memory layout is required.\nPR:N - Triggering requires only sending unauthenticated IPv4 packets that match an already-configured SRv6 encap route; the attacker needs no account or capability on the target.\nUI:N - Packet processing runs entirely in the kernel receive/forward path with no victim user action beyond the router already having SRv6 encap configured.\nS:U - The NULL dereference oopses the same host kernel that performs forwarding and does not cross a VM, IOMMU, or other security-authority boundary.\nC:N - This is a pure NULL pointer dereference of idev in ip6_forward() after iif is cleared to zero, with no OOB read, UAF, or other information-disclosure primitive.\nI:N - The fault is a straight NULL dereference of idev-\u003ecnf.disable_policy with no write primitive, type confusion, or memory corruption that could alter kernel state or hijack control flow.\nA:H - Dereferencing the NULL inet6_dev pointer in ip6_forward() causes a kernel oops/panic and can be re-triggered at will by remote packets, taking down the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:48:12.387Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3"
},
{
"url": "https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e"
},
{
"url": "https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9"
},
{
"url": "https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831"
},
{
"url": "https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1"
},
{
"url": "https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c"
}
],
"title": "seg6: fix the iif in the IPv6 socket control block",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47515",
"datePublished": "2024-05-24T15:09:29.334Z",
"dateReserved": "2024-05-24T15:02:54.824Z",
"dateUpdated": "2026-08-05T08:48:12.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…