{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47036", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-27T18:42:55.965Z", "datePublished": "2024-02-28T08:13:44.034Z", "dateUpdated": "2026-08-05T08:45:39.890Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:39.890Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: skip L4 aggregation for UDP tunnel packets\n\nIf NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there\nare UDP tunnels available in the system, udp_gro_receive() could end-up\ndoing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at\nthe outer UDP tunnel level for packets effectively carrying and UDP\ntunnel header.\n\nThat could cause inner protocol corruption. If e.g. the relevant\npackets carry a vxlan header, different vxlan ids will be ignored/\naggregated to the same GSO packet. Inner headers will be ignored, too,\nso that e.g. TCP over vxlan push packets will be held in the GRO\nengine till the next flush, etc.\n\nJust skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the\ncurrent packet could land in a UDP tunnel, and let udp_gro_receive()\ndo GRO via udp_sk(sk)->gro_receive.\n\nThe check implemented in this patch is broader than what is strictly\nneeded, as the existing UDP tunnel could be e.g. configured on top of\na different device: we could end-up skipping GRO at-all for some packets.\n\nAnyhow, that is a very thin corner case and covering it will add quite\na bit of complexity.\n\nv1 -> v2:\n - hopefully clarify the commit message" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The bug is in udp_gro_receive()/udp4_gro_receive on the NAPI GRO receive path for inbound UDP packets, so a remote peer triggers it by sending UDP/VXLAN/Geneve traffic to a host with UDP tunnels; no local syscall is required.\nAC:L - With rx-gro-list or rx-udp-gro-forwarding enabled (the vulnerable configuration assumed for Base scoring), an attacker can reliably force incorrect L4/fraglist aggregation by sending packets that share the outer UDP flow while differing in inner tunnel headers; no race or uncontrolled memory layout is required.\nPR:N - Packet processing occurs in the kernel networking stack before any application authentication; sending UDP packets to the tunnel port needs no account or capability on the target.\nUI:N - Exploitation is fully driven by attacker-sent packets against an already-configured UDP tunnel endpoint; no victim user action is required.\nS:U - Impact stays within the host kernel network stack and tunnel datapath under the same OS security authority; this is not a VM/IOMMU/sandbox escape.\nC:H - Incorrect outer-UDP aggregation ignores VXLAN/Geneve identifiers and can merge packets from different tunnel namespaces into one GSO unit, enabling cross-tenant/cross-VNI exposure of encapsulated payloads in multi-tenant overlay deployments.\nI:H - The fix documents inner protocol corruption: different VXLAN IDs are aggregated, inner headers are ignored, and tunnel/TCP streams are rewritten into incorrect GSO packets, which is attacker-influenced corruption of network data integrity.\nA:H - Mis-aggregation holds and corrupts tunnel traffic (including TCP-over-VXLAN delayed until GRO flush) and can produce malformed GSO/fraglist skbs on the tunnel receive path, denying overlay service and aligning with the related GRO-into-tunnel crash class." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/udp_offload.c" ], "versions": [ { "version": "9fd1ff5d2ac7181844735806b0a703c942365291", "lessThan": "450687386cd16d081b58cd7a342acff370a96078", "status": "affected", "versionType": "git" }, { "version": "9fd1ff5d2ac7181844735806b0a703c942365291", "lessThan": "18f25dc399901426dff61e676ba603ff52c666f7", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/udp_offload.c" ], "versions": [ { "version": "5.6", "status": "affected" }, { "version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver" }, { "version": "5.12.4", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.12.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/450687386cd16d081b58cd7a342acff370a96078" }, { "url": "https://git.kernel.org/stable/c/18f25dc399901426dff61e676ba603ff52c666f7" } ], "title": "udp: skip L4 aggregation for UDP tunnel packets", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-47036", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-02-28T20:31:59.928019Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:14:33.835Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.049Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/450687386cd16d081b58cd7a342acff370a96078", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/18f25dc399901426dff61e676ba603ff52c666f7", "tags": [ "x_transferred" ] } ] } ] } }