{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47163", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-25T09:12:14.109Z", "datePublished": "2024-03-25T09:16:16.676Z", "dateUpdated": "2026-08-05T08:46:27.215Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:27.215Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: wait and exit until all work queues are done\n\nOn some host, a crash could be triggered simply by repeating these\ncommands several times:\n\n # modprobe tipc\n # tipc bearer enable media udp name UDP1 localip 127.0.0.1\n # rmmod tipc\n\n [] BUG: unable to handle kernel paging request at ffffffffc096bb00\n [] Workqueue: events 0xffffffffc096bb00\n [] Call Trace:\n [] ? process_one_work+0x1a7/0x360\n [] ? worker_thread+0x30/0x390\n [] ? create_worker+0x1a0/0x1a0\n [] ? kthread+0x116/0x130\n [] ? kthread_flush_work_fn+0x10/0x10\n [] ? ret_from_fork+0x35/0x40\n\nWhen removing the TIPC module, the UDP tunnel sock will be delayed to\nrelease in a work queue as sock_release() can't be done in rtnl_lock().\nIf the work queue is schedule to run after the TIPC module is removed,\nkernel will crash as the work queue function cleanup_beareri() code no\nlonger exists when trying to invoke it.\n\nTo fix it, this patch introduce a member wq_count in tipc_net to track\nthe numbers of work queues in schedule, and wait and exit until all\nwork queues are done in tipc_exit_net()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached via local tipc generic-netlink bearer enable/disable and netns teardown (or local rmmod of tipc); it is not triggered by processing unsolicited remote TIPC/UDP packets.\nAC:L - The attacker controls both sides of the race by enabling a UDP bearer and then destroying the netns (or repeating modprobe/enable/rmmod), so the pending cleanup_bearer work is reliably left running after tipc_exit_net returns.\nPR:L - At the time of this bug, TIPCv2 bearer mutators lacked GENL_ADMIN_PERM, and an unprivileged user can create a user+net namespace (unshare -Urn) and enable a tipc UDP bearer whenever tipc is loaded; CAP_NET_ADMIN in a userns is also Low per guidance.\nUI:N - No victim action is required; the attacker enables the bearer and tears down their own netns (or unloads tipc) entirely on their own.\nS:U - Impact is a host-kernel use-after-free/crash within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossing.\nC:H - tipc_exit_net returns without waiting for cleanup_bearer while kernel UDP sockets hold no netns refcount, so the work runs against freed net/module state; this UAF can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same UAF (and the module-unload path that invokes freed cleanup_bearer text via the workqueue) is memory corruption exploitable for write primitives and control-flow hijacking, not merely a clean crash.\nA:H - The reported failure is a kernel paging-request oops when the workqueue runs after tipc teardown/unload, and the netns UAF path likewise causes kernel crashes." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/tipc/core.c", "net/tipc/core.h", "net/tipc/udp_media.c" ], "versions": [ { "version": "d0f91938bede204a343473792529e0db7d599836", "lessThan": "d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa", "status": "affected", "versionType": "git" }, { "version": "d0f91938bede204a343473792529e0db7d599836", "lessThan": "5195ec5e365a2a9331bfeb585b613a6e94f98dba", "status": "affected", "versionType": "git" }, { "version": "d0f91938bede204a343473792529e0db7d599836", "lessThan": "b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d", "status": "affected", "versionType": "git" }, { "version": "d0f91938bede204a343473792529e0db7d599836", "lessThan": "04c26faa51d1e2fe71cf13c45791f5174c37f986", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/tipc/core.c", "net/tipc/core.h", "net/tipc/udp_media.c" ], "versions": [ { "version": "4.1", "status": "affected" }, { "version": "0", "lessThan": "4.1", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.124", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.42", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.12.9", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "5.4.124" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "5.10.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "5.12.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "5.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa" }, { "url": "https://git.kernel.org/stable/c/5195ec5e365a2a9331bfeb585b613a6e94f98dba" }, { "url": "https://git.kernel.org/stable/c/b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d" }, { "url": "https://git.kernel.org/stable/c/04c26faa51d1e2fe71cf13c45791f5174c37f986" } ], "title": "tipc: wait and exit until all work queues are done", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-47163", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-04-01T19:41:39.688056Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:15:00.578Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.948Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/5195ec5e365a2a9331bfeb585b613a6e94f98dba", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/04c26faa51d1e2fe71cf13c45791f5174c37f986", "tags": [ "x_transferred" ] } ] } ] } }