{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-46912", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-25T13:45:52.718Z", "datePublished": "2024-02-27T06:53:52.135Z", "dateUpdated": "2026-08-05T08:45:03.123Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:03.123Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Make tcp_allowed_congestion_control readonly in non-init netns\n\nCurrently, tcp_allowed_congestion_control is global and writable;\nwriting to it in any net namespace will leak into all other net\nnamespaces.\n\ntcp_available_congestion_control and tcp_allowed_congestion_control are\nthe only sysctls in ipv4_net_table (the per-netns sysctl table) with a\nNULL data pointer; their handlers (proc_tcp_available_congestion_control\nand proc_allowed_congestion_control) have no other way of referencing a\nstruct net. Thus, they operate globally.\n\nBecause ipv4_net_table does not use designated initializers, there is no\neasy way to fix up this one \"bad\" table entry. However, the data pointer\nupdating logic shouldn't be applied to NULL pointers anyway, so we\ninstead force these entries to be read-only.\n\nThese sysctls used to exist in ipv4_table (init-net only), but they were\nmoved to the per-net ipv4_net_table, presumably without realizing that\ntcp_allowed_congestion_control was writable and thus introduced a leak.\n\nBecause the intent of that commit was only to know (i.e. read) \"which\ncongestion algorithms are available or allowed\", this read-only solution\nshould be sufficient.\n\nThe logic added in recent commit\n31c4d2f160eb: (\"net: Ensure net namespace isolation of sysctls\")\ndoes not and cannot check for NULL data pointers, because\nother table entries (e.g. /proc/sys/net/netfilter/nf_log/) have\n.data=NULL but use other methods (.extra2) to access the struct net." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local access to write /proc/sys/net/ipv4/tcp_allowed_congestion_control (via userns+netns sysctl), not remote packet processing.\nAC:L - The attacker reliably triggers the bug with a single sysctl write; no races, special memory layout, or conditions outside their control.\nPR:L - Writing the net sysctl needs CAP_NET_ADMIN in the netns's user_ns, which an unprivileged user obtains via unshare/CLONE_NEWUSER|CLONE_NEWNET (net_ctl_permissions), not real host root.\nUI:N - No victim action is required; the attacker creates namespaces and writes the sysctl themselves.\nS:C - The write modifies global TCP_CONG_NON_RESTRICTED flags shared across all net namespaces, crossing the netns isolation boundary so a child/container netns impacts init_net and other namespaces.\nC:N - The bug only changes the global allowlist; it does not disclose kernel memory or other confidential data beyond what was already world-readable.\nI:H - The attacker fully rewrites the system-wide tcp_allowed_congestion_control policy (including clearing all NON_RESTRICTED flags or enabling restricted/BPF algorithms for all unprivileged processes), a complete loss of that protection mechanism across the host.\nA:L - Clearing or shrinking the allowlist can deny unprivileged host processes the ability to select congestion algorithms via setsockopt, impairing functionality/performance, but there is no kernel crash, panic, or hang." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/sysctl_net_ipv4.c" ], "versions": [ { "version": "9cb8e048e5d93825ec5e8dfb5b8df4987ea25745", "lessThan": "35d7491e2f77ce480097cabcaf93ed409e916e12", "status": "affected", "versionType": "git" }, { "version": "9cb8e048e5d93825ec5e8dfb5b8df4987ea25745", "lessThan": "1ccdf1bed140820240e383ba0accc474ffc7f006", "status": "affected", "versionType": "git" }, { "version": "9cb8e048e5d93825ec5e8dfb5b8df4987ea25745", "lessThan": "97684f0970f6e112926de631fdd98d9693c7e5c1", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/sysctl_net_ipv4.c" ], "versions": [ { "version": "5.7", "status": "affected" }, { "version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.32", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.11.16", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.32" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.11.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/35d7491e2f77ce480097cabcaf93ed409e916e12" }, { "url": "https://git.kernel.org/stable/c/1ccdf1bed140820240e383ba0accc474ffc7f006" }, { "url": "https://git.kernel.org/stable/c/97684f0970f6e112926de631fdd98d9693c7e5c1" } ], "title": "net: Make tcp_allowed_congestion_control readonly in non-init netns", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-46912", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-02-27T16:08:06.856506Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:13:13.524Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:42.998Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/35d7491e2f77ce480097cabcaf93ed409e916e12", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1ccdf1bed140820240e383ba0accc474ffc7f006", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/97684f0970f6e112926de631fdd98d9693c7e5c1", "tags": [ "x_transferred" ] } ] } ] } }