CVE-2021-46955 (GCVE-0-2021-46955)

Vulnerability from cvelistv5 – Published: 2024-02-27 18:46 – Updated: 2026-05-23 15:18
VLAI
Title
openvswitch: fix stack OOB read while fragmenting IPv4 packets
Summary
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix stack OOB read while fragmenting IPv4 packets running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets: BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367 CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 ovs_fragment+0x5bf/0x840 [openvswitch] do_execute_actions+0x1bd5/0x2400 [openvswitch] ovs_execute_actions+0xc8/0x3d0 [openvswitch] ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch] genl_family_rcv_msg_doit.isra.15+0x227/0x2d0 genl_rcv_msg+0x287/0x490 netlink_rcv_skb+0x120/0x380 genl_rcv+0x24/0x40 netlink_unicast+0x439/0x630 netlink_sendmsg+0x719/0xbf0 sock_sendmsg+0xe2/0x110 ____sys_sendmsg+0x5ba/0x890 ___sys_sendmsg+0xe9/0x160 __sys_sendmsg+0xd3/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f957079db07 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48 RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07 RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019 RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0 The buggy address belongs to the page: page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7 flags: 0x17ffffc0000000() raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame: ovs_fragment+0x0/0x840 [openvswitch] this frame has 2 objects: [32, 144) 'ovs_dst' [192, 424) 'ovs_rt' Memory state around the buggy address: ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 >ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 ^ ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00 for IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then, in the following call graph: ip_do_fragment() ip_skb_dst_mtu() ip_dst_mtu_maybe_forward() ip_mtu_locked() the pointer to struct dst_entry is used as pointer to struct rtable: this turns the access to struct members like rt_mtu_locked into an OOB read in the stack. Fix this changing the temporary variable used for IPv4 packets in ovs_fragment(), similarly to what is done for IPv6 few lines below.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 119bbaa6795a4f4aed46994cc7d9ab01989c87e3 , < b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f (git)
Affected: d543907a4730400f5c5b684c57cb5bbbfd6136ab , < 23e17ec1a5eb53fe39cc34fa5592686d5acd0dac (git)
Affected: 8387fbac8e18e26a60559adc63e0b7067303b0a4 , < 5a52fa8ad45b5a593ed416adf326538638454ff1 (git)
Affected: d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 , < df9e900de24637be41879e2c50afb713ec4e8b2e (git)
Affected: d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 , < 490ad0a2390442d0a7b8c00972a83dbb09cab142 (git)
Affected: d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 , < a1478374b0bda89b4277a8afd39208271faad4be (git)
Affected: d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 , < d841d3cf5297fde4ce6a41ff35451d0e82917f3e (git)
Affected: d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 , < b3502b04e84ac5349be95fc033c17bd701d2787a (git)
Affected: d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 , < 7c0ea5930c1c211931819d83cfb157bff1539a4c (git)
Affected: df9ece1148e2ec242871623dedb004f7a1387125 (git)
Affected: 4.4.134 , < 4.4.269 (semver)
Affected: 4.9.104 , < 4.9.269 (semver)
Affected: 4.14.45 , < 4.14.233 (semver)
Affected: 3.16.57 , < 3.17 (semver)
Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 4.4.269 , ≤ 4.4.* (semver)
Unaffected: 4.9.269 , ≤ 4.9.* (semver)
Unaffected: 4.14.233 , ≤ 4.14.* (semver)
Unaffected: 4.19.191 , ≤ 4.19.* (semver)
Unaffected: 5.4.118 , ≤ 5.4.* (semver)
Unaffected: 5.10.36 , ≤ 5.10.* (semver)
Unaffected: 5.11.20 , ≤ 5.11.* (semver)
Unaffected: 5.12.3 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46955",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-28T17:01:12.713223Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-28T17:01:24.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:42.889Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/actions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f",
              "status": "affected",
              "version": "119bbaa6795a4f4aed46994cc7d9ab01989c87e3",
              "versionType": "git"
            },
            {
              "lessThan": "23e17ec1a5eb53fe39cc34fa5592686d5acd0dac",
              "status": "affected",
              "version": "d543907a4730400f5c5b684c57cb5bbbfd6136ab",
              "versionType": "git"
            },
            {
              "lessThan": "5a52fa8ad45b5a593ed416adf326538638454ff1",
              "status": "affected",
              "version": "8387fbac8e18e26a60559adc63e0b7067303b0a4",
              "versionType": "git"
            },
            {
              "lessThan": "df9e900de24637be41879e2c50afb713ec4e8b2e",
              "status": "affected",
              "version": "d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221",
              "versionType": "git"
            },
            {
              "lessThan": "490ad0a2390442d0a7b8c00972a83dbb09cab142",
              "status": "affected",
              "version": "d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221",
              "versionType": "git"
            },
            {
              "lessThan": "a1478374b0bda89b4277a8afd39208271faad4be",
              "status": "affected",
              "version": "d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221",
              "versionType": "git"
            },
            {
              "lessThan": "d841d3cf5297fde4ce6a41ff35451d0e82917f3e",
              "status": "affected",
              "version": "d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221",
              "versionType": "git"
            },
            {
              "lessThan": "b3502b04e84ac5349be95fc033c17bd701d2787a",
              "status": "affected",
              "version": "d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221",
              "versionType": "git"
            },
            {
              "lessThan": "7c0ea5930c1c211931819d83cfb157bff1539a4c",
              "status": "affected",
              "version": "d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "df9ece1148e2ec242871623dedb004f7a1387125",
              "versionType": "git"
            },
            {
              "lessThan": "4.4.269",
              "status": "affected",
              "version": "4.4.134",
              "versionType": "semver"
            },
            {
              "lessThan": "4.9.269",
              "status": "affected",
              "version": "4.9.104",
              "versionType": "semver"
            },
            {
              "lessThan": "4.14.233",
              "status": "affected",
              "version": "4.14.45",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.57",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/actions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.233",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.269",
                  "versionStartIncluding": "4.4.134",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.269",
                  "versionStartIncluding": "4.9.104",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.233",
                  "versionStartIncluding": "4.14.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.191",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.118",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.36",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.20",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.57",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix stack OOB read while fragmenting IPv4 packets\n\nrunning openvswitch on kernels built with KASAN, it\u0027s possible to see the\nfollowing splat while testing fragmentation of IPv4 packets:\n\n BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60\n Read of size 1 at addr ffff888112fc713c by task handler2/1367\n\n CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\n Call Trace:\n  dump_stack+0x92/0xc1\n  print_address_description.constprop.7+0x1a/0x150\n  kasan_report.cold.13+0x7f/0x111\n  ip_do_fragment+0x1b03/0x1f60\n  ovs_fragment+0x5bf/0x840 [openvswitch]\n  do_execute_actions+0x1bd5/0x2400 [openvswitch]\n  ovs_execute_actions+0xc8/0x3d0 [openvswitch]\n  ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]\n  genl_family_rcv_msg_doit.isra.15+0x227/0x2d0\n  genl_rcv_msg+0x287/0x490\n  netlink_rcv_skb+0x120/0x380\n  genl_rcv+0x24/0x40\n  netlink_unicast+0x439/0x630\n  netlink_sendmsg+0x719/0xbf0\n  sock_sendmsg+0xe2/0x110\n  ____sys_sendmsg+0x5ba/0x890\n  ___sys_sendmsg+0xe9/0x160\n  __sys_sendmsg+0xd3/0x170\n  do_syscall_64+0x33/0x40\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7f957079db07\n Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48\n RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07\n RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019\n RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730\n R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\n R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0\n\n The buggy address belongs to the page:\n page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7\n flags: 0x17ffffc0000000()\n raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:\n  ovs_fragment+0x0/0x840 [openvswitch]\n\n this frame has 2 objects:\n  [32, 144) \u0027ovs_dst\u0027\n  [192, 424) \u0027ovs_rt\u0027\n\n Memory state around the buggy address:\n  ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00\n \u003effff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00\n                                         ^\n  ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00\n\nfor IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,\nin the following call graph:\n\n  ip_do_fragment()\n    ip_skb_dst_mtu()\n      ip_dst_mtu_maybe_forward()\n        ip_mtu_locked()\n\nthe pointer to struct dst_entry is used as pointer to struct rtable: this\nturns the access to struct members like rt_mtu_locked into an OOB read in\nthe stack. Fix this changing the temporary variable used for IPv4 packets\nin ovs_fragment(), similarly to what is done for IPv6 few lines below."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:18:45.511Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f"
        },
        {
          "url": "https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1"
        },
        {
          "url": "https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be"
        },
        {
          "url": "https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c"
        }
      ],
      "title": "openvswitch: fix stack OOB read while fragmenting IPv4 packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46955",
    "datePublished": "2024-02-27T18:46:57.428Z",
    "dateReserved": "2024-02-27T18:42:55.937Z",
    "dateUpdated": "2026-05-23T15:18:45.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-46955",
      "date": "2026-06-07",
      "epss": "0.00011",
      "percentile": "0.01509"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-46955\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-02-27T19:04:06.667\",\"lastModified\":\"2024-12-06T17:53:52.043\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nopenvswitch: fix stack OOB read while fragmenting IPv4 packets\\n\\nrunning openvswitch on kernels built with KASAN, it\u0027s possible to see the\\nfollowing splat while testing fragmentation of IPv4 packets:\\n\\n BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60\\n Read of size 1 at addr ffff888112fc713c by task handler2/1367\\n\\n CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418\\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\\n Call Trace:\\n  dump_stack+0x92/0xc1\\n  print_address_description.constprop.7+0x1a/0x150\\n  kasan_report.cold.13+0x7f/0x111\\n  ip_do_fragment+0x1b03/0x1f60\\n  ovs_fragment+0x5bf/0x840 [openvswitch]\\n  do_execute_actions+0x1bd5/0x2400 [openvswitch]\\n  ovs_execute_actions+0xc8/0x3d0 [openvswitch]\\n  ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]\\n  genl_family_rcv_msg_doit.isra.15+0x227/0x2d0\\n  genl_rcv_msg+0x287/0x490\\n  netlink_rcv_skb+0x120/0x380\\n  genl_rcv+0x24/0x40\\n  netlink_unicast+0x439/0x630\\n  netlink_sendmsg+0x719/0xbf0\\n  sock_sendmsg+0xe2/0x110\\n  ____sys_sendmsg+0x5ba/0x890\\n  ___sys_sendmsg+0xe9/0x160\\n  __sys_sendmsg+0xd3/0x170\\n  do_syscall_64+0x33/0x40\\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\\n RIP: 0033:0x7f957079db07\\n Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48\\n RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\\n RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07\\n RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019\\n RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730\\n R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\\n R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0\\n\\n The buggy address belongs to the page:\\n page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7\\n flags: 0x17ffffc0000000()\\n raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000\\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:\\n  ovs_fragment+0x0/0x840 [openvswitch]\\n\\n this frame has 2 objects:\\n  [32, 144) \u0027ovs_dst\u0027\\n  [192, 424) \u0027ovs_rt\u0027\\n\\n Memory state around the buggy address:\\n  ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n  ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00\\n \u003effff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00\\n                                         ^\\n  ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n  ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00\\n\\nfor IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,\\nin the following call graph:\\n\\n  ip_do_fragment()\\n    ip_skb_dst_mtu()\\n      ip_dst_mtu_maybe_forward()\\n        ip_mtu_locked()\\n\\nthe pointer to struct dst_entry is used as pointer to struct rtable: this\\nturns the access to struct members like rt_mtu_locked into an OOB read in\\nthe stack. Fix this changing the temporary variable used for IPv4 packets\\nin ovs_fragment(), similarly to what is done for IPv6 few lines below.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: openvswitch: corrige la lectura OOB de la pila al fragmentar paquetes IPv4 al ejecutar openvswitch en kernels creados con KASAN, es posible ver el siguiente s\u00edmbolo al probar la fragmentaci\u00f3n de paquetes IPv4: ERROR: KASAN: stack- fuera de los l\u00edmites en ip_do_fragment+0x1b03/0x1f60 Lectura de tama\u00f1o 1 en la direcci\u00f3n ffff888112fc713c por task handler2/1367 CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418 Nombre de hardware: Red Hat KVM, BIOS 1.11 .1-4.module+el8.1.0+4066+0f1aadab 01/04/2014 Seguimiento de llamadas: dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 ovs_fragment+0x5bf/0x840 [openvswitch] do_execute_actions+0x1bd5/0x2400 [openvswitch] ovs_execute_actions+0xc8/0x3d0 [openvswitch] ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch] genl_family_rcv_msg_do it.isra.15+0x227/0x2d0 genl_rcv_msg+0x287/0x490 netlink_rcv_skb+0x120/ 0x380 genl_rcv+0x24/0x40 netlink_unicast+0x439/0x630 netlink_sendmsg+0x719/0xbf0 sock_sendmsg+0xe2/0x110 ____sys_sendmsg+0x5ba/0x890 ___sys_sendmsg+0xe9/0x160 __sy s_sendmsg+0xd3/0x170 do_syscall_64+0x33/0x40 Entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033: 0x7f957079db07 C\u00f3digo: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48 RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RB X: 0000000000000019 RCX: 00007f957079db07 RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019 RBP: 00007f956ce35ae0 R08: 00000000000000000 R09: 00007f9558006730 R10: 0000000000000000 R11: 00000000000000293 R12: 0000000000000000 R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0 La direcci\u00f3n del error pertenece a la p\u00e1gina: p\u00e1gina:00000000af2a1d93 refcount:0 mapcount:0 mapeo:00000000000000000 index:0x0 pfn: 0x112fc7 banderas: 0x17ffffc0000000() sin formato: 0017ffffc0000000 0000000000000000 muerto000000000122 00000000000000000 sin formato: 0000000000000000 000000000000 0000 00000000ffffffff 0000000000000000 p\u00e1gina volcada porque: kasan: mal acceso detectado addr ffff888112fc713c est\u00e1 ubicado en la pila del controlador de tareas 2/1367 en el desplazamiento 180 en el framework: ovs_fragment+0x0/0x840 [ openvswitch] este framework tiene 2 objetos: [32, 144) \u0027ovs_dst\u0027 [192, 424) \u0027ovs_rt\u0027 Estado de la memoria alrededor de la direcci\u00f3n del error: ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88811 2fc7080 : 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 \u0026gt;ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 ^ ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00 para paquetes IPv4, ovs_fragment() utiliza una estructura temporal dst_entry. Luego, en el siguiente gr\u00e1fico de llamadas: ip_do_fragment() ip_skb_dst_mtu() ip_dst_mtu_maybe_forward() ip_mtu_locked() el puntero a struct dst_entry se usa como puntero a struct rtable: esto convierte el acceso a miembros de estructura como rt_mtu_locked en una lectura OOB en la pila. Solucione este problema cambiando la variable temporal utilizada para los paquetes IPv4 en ovs_fragment(), de manera similar a lo que se hace para IPv6 unas l\u00edneas m\u00e1s abajo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.134\",\"versionEndExcluding\":\"4.4.269\",\"matchCriteriaId\":\"65ED7534-D47C-47CE-BF7D-8022A6B38C4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.104\",\"versionEndExcluding\":\"4.9.269\",\"matchCriteriaId\":\"634D2BFA-73FA-4C9A-B897-11E3DD69E039\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.45\",\"versionEndExcluding\":\"4.14.233\",\"matchCriteriaId\":\"4C007C3B-E2A3-42E4-97C1-FDAC6B8515E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16\",\"versionEndExcluding\":\"4.19.191\",\"matchCriteriaId\":\"F677F1C8-2451-43EC-9555-E283697C189E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.118\",\"matchCriteriaId\":\"C83F5505-AF9D-4F2A-8D37-A8EB73ED772D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.36\",\"matchCriteriaId\":\"003E22D0-CA29-4338-8B35-0754C740074F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.11.20\",\"matchCriteriaId\":\"EEC03413-9760-46D4-AC1D-EB084A1D4111\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.12.3\",\"matchCriteriaId\":\"F9D6B2DE-7E4A-4B3B-9AEE-3A2C5F23DA32\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:17:42.889Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-46955\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-28T17:01:12.713223Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-28T17:01:21.743Z\"}}], \"cna\": {\"title\": \"openvswitch: fix stack OOB read while fragmenting IPv4 packets\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"119bbaa6795a4f4aed46994cc7d9ab01989c87e3\", \"lessThan\": \"b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d543907a4730400f5c5b684c57cb5bbbfd6136ab\", \"lessThan\": \"23e17ec1a5eb53fe39cc34fa5592686d5acd0dac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8387fbac8e18e26a60559adc63e0b7067303b0a4\", \"lessThan\": \"5a52fa8ad45b5a593ed416adf326538638454ff1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221\", \"lessThan\": \"df9e900de24637be41879e2c50afb713ec4e8b2e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221\", \"lessThan\": \"490ad0a2390442d0a7b8c00972a83dbb09cab142\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221\", \"lessThan\": \"a1478374b0bda89b4277a8afd39208271faad4be\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221\", \"lessThan\": \"d841d3cf5297fde4ce6a41ff35451d0e82917f3e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221\", \"lessThan\": \"b3502b04e84ac5349be95fc033c17bd701d2787a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221\", \"lessThan\": \"7c0ea5930c1c211931819d83cfb157bff1539a4c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"df9ece1148e2ec242871623dedb004f7a1387125\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.4.134\", \"lessThan\": \"4.4.269\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.9.104\", \"lessThan\": \"4.9.269\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.14.45\", \"lessThan\": \"4.14.233\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.16.57\", \"lessThan\": \"3.17\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/openvswitch/actions.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.4.269\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.4.*\"}, {\"status\": \"unaffected\", \"version\": \"4.9.269\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.233\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.191\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.118\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.11.20\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.11.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/openvswitch/actions.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f\"}, {\"url\": \"https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac\"}, {\"url\": \"https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1\"}, {\"url\": \"https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e\"}, {\"url\": \"https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142\"}, {\"url\": \"https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be\"}, {\"url\": \"https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e\"}, {\"url\": \"https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a\"}, {\"url\": \"https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nopenvswitch: fix stack OOB read while fragmenting IPv4 packets\\n\\nrunning openvswitch on kernels built with KASAN, it\u0027s possible to see the\\nfollowing splat while testing fragmentation of IPv4 packets:\\n\\n BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60\\n Read of size 1 at addr ffff888112fc713c by task handler2/1367\\n\\n CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418\\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\\n Call Trace:\\n  dump_stack+0x92/0xc1\\n  print_address_description.constprop.7+0x1a/0x150\\n  kasan_report.cold.13+0x7f/0x111\\n  ip_do_fragment+0x1b03/0x1f60\\n  ovs_fragment+0x5bf/0x840 [openvswitch]\\n  do_execute_actions+0x1bd5/0x2400 [openvswitch]\\n  ovs_execute_actions+0xc8/0x3d0 [openvswitch]\\n  ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]\\n  genl_family_rcv_msg_doit.isra.15+0x227/0x2d0\\n  genl_rcv_msg+0x287/0x490\\n  netlink_rcv_skb+0x120/0x380\\n  genl_rcv+0x24/0x40\\n  netlink_unicast+0x439/0x630\\n  netlink_sendmsg+0x719/0xbf0\\n  sock_sendmsg+0xe2/0x110\\n  ____sys_sendmsg+0x5ba/0x890\\n  ___sys_sendmsg+0xe9/0x160\\n  __sys_sendmsg+0xd3/0x170\\n  do_syscall_64+0x33/0x40\\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\\n RIP: 0033:0x7f957079db07\\n Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48\\n RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\\n RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07\\n RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019\\n RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730\\n R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\\n R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0\\n\\n The buggy address belongs to the page:\\n page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7\\n flags: 0x17ffffc0000000()\\n raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000\\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:\\n  ovs_fragment+0x0/0x840 [openvswitch]\\n\\n this frame has 2 objects:\\n  [32, 144) \u0027ovs_dst\u0027\\n  [192, 424) \u0027ovs_rt\u0027\\n\\n Memory state around the buggy address:\\n  ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n  ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00\\n \u003effff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00\\n                                         ^\\n  ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n  ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00\\n\\nfor IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,\\nin the following call graph:\\n\\n  ip_do_fragment()\\n    ip_skb_dst_mtu()\\n      ip_dst_mtu_maybe_forward()\\n        ip_mtu_locked()\\n\\nthe pointer to struct dst_entry is used as pointer to struct rtable: this\\nturns the access to struct members like rt_mtu_locked into an OOB read in\\nthe stack. Fix this changing the temporary variable used for IPv4 packets\\nin ovs_fragment(), similarly to what is done for IPv6 few lines below.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.4.269\", \"versionStartIncluding\": \"4.4.134\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.269\", \"versionStartIncluding\": \"4.9.104\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.233\", \"versionStartIncluding\": \"4.14.45\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.191\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.118\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.36\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.11.20\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.3\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.16.57\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:18:45.511Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-46955\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:18:45.511Z\", \"dateReserved\": \"2024-02-27T18:42:55.937Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-27T18:46:57.428Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.