inet: fully convert sk->sk_rx_dst to RCU rules

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2021-47103
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-03-04 18:15:08 UTC
Updated2026-08-04 10:16:45 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearly documenting it. And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv() are not following standard RCU rules. [a] dst_release(dst); [b] sk->sk_rx_dst = NULL; They look wrong because a delete operation of RCU protected pointer is supposed to clear the pointer before the call_rcu()/synchronize_rcu() guarding actual memory freeing. In some cases indeed, dst could be freed before [b] is done. We could cheat by clearing sk_rx_dst before calling dst_release(), but this seems the right time to stick to standard RCU annotations and debugging facilities. [1] BUG: KASAN: use-after-free in dst_check include/net/dst.h:470 [inline] BUG: KASAN: use-after-free in tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792 Read of size 2 at addr ffff88807f1cb73a by task syz-executor.5/9204 CPU: 0 PID: 9204 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:450 dst_check include/net/dst.h:470 [inline] tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792 ip_rcv_finish_core.constprop.0+0x15de/0x1e80 net/ipv4/ip_input.c:340 ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583 ip_sublist_rcv net/ipv4/ip_input.c:609 [inline] ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644 __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline] __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556 __netif_receive_skb_list net/core/dev.c:5608 [inline] netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699 gro_normal_list net/core/dev.c:5853 [inline] gro_normal_list net/core/dev.c:5849 [inline] napi_complete_done+0x1f1/0x880 net/core/dev.c:6590 virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline] virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557 __napi_poll+0xaf/0x440 net/core/dev.c:7023 napi_poll net/core/dev.c:7090 [inline] net_rx_action+0x801/0xb40 net/core/dev.c:7177 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 common_interrupt+0x52/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629 RIP: 0033:0x7f5e972bfd57 Code: 39 d1 73 14 0f 1f 80 00 00 00 00 48 8b 50 f8 48 83 e8 08 48 39 ca 77 f3 48 39 c3 73 3e 48 89 13 48 8b 50 f8 48 89 38 49 8b 0e <48> 8b 3e 48 83 c3 08 48 83 c6 08 eb bc 48 39 d1 72 9e 48 39 d0 73 RSP: 002b:00007fff8a413210 EFLAGS: 00000283 RAX: 00007f5e97108990 RBX: 00007f5e97108338 RCX: ffffffff81d3aa45 RDX: ffffffff81d3aa45 RSI: 00007f5e97108340 RDI: ffffffff81d3aa45 RBP: 00007f5e97107eb8 R08: 00007f5e97108d88 R09: 0000000093c2e8d9 R10: 0000000000000000 R11: 0000000000000000 R12: 00007f5e97107eb0 R13: 00007f5e97108338 R14: 00007f5e97107ea8 R15: 0000000000000019 </TASK> Allocated by task 13: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:259 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:3234 [inline] slab_alloc mm/slub.c:3242 [inline] kmem_cache_alloc+0x202/0x3a0 mm/slub.c:3247 dst_alloc+0x146/0x1f0 net/core/dst.c:92 rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613 ip_route_input_slow+0x1817/0x3a20 net/ipv4/route.c:234 ---truncated---

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-416

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 41063e9dd11956f2d285e12e4342e1d232ba0ea2 68c34ce11ef23328692aa35fa6aaafdd75913100 git Not specified
CNA Linux Linux affected 41063e9dd11956f2d285e12e4342e1d232ba0ea2 92e6e36ecd16808866ac6172b9491b5097cde449 git Not specified
CNA Linux Linux affected 41063e9dd11956f2d285e12e4342e1d232ba0ea2 75a578000ae5e511e5d0e8433c94a14d9c99c412 git Not specified
CNA Linux Linux affected 41063e9dd11956f2d285e12e4342e1d232ba0ea2 c3bb4a7e8cbc984e1cdac0fe6af60e880214ed6e git Not specified
CNA Linux Linux affected 41063e9dd11956f2d285e12e4342e1d232ba0ea2 f039b43cbaea5e0700980c2f0052da05a70782e0 git Not specified
CNA Linux Linux affected 41063e9dd11956f2d285e12e4342e1d232ba0ea2 0249a4b8a554f2eb6a27b62516fa50168584faa4 git Not specified
CNA Linux Linux affected 41063e9dd11956f2d285e12e4342e1d232ba0ea2 8f905c0e7354ef261360fb7535ea079b1082c105 git Not specified
CNA Linux Linux affected 3.6 Not specified
CNA Linux Linux unaffected 3.6 semver Not specified
CNA Linux Linux unaffected 4.9.331 4.9.* semver Not specified
CNA Linux Linux unaffected 4.14.296 4.14.* semver Not specified
CNA Linux Linux unaffected 4.19.262 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.220 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.150 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.12 5.15.* semver Not specified
CNA Linux Linux unaffected 5.16 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/f039b43cbaea5e0700980c2f0052da05a70782e0 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Exploit, Mailing List, Patch
git.kernel.org/stable/c/92e6e36ecd16808866ac6172b9491b5097cde449 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Exploit, Mailing List, Patch
git.kernel.org/stable/c/c3bb4a7e8cbc984e1cdac0fe6af60e880214ed6e af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Exploit, Mailing List, Patch
git.kernel.org/stable/c/75a578000ae5e511e5d0e8433c94a14d9c99c412 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Exploit, Mailing List, Patch
git.kernel.org/stable/c/68c34ce11ef23328692aa35fa6aaafdd75913100 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Exploit, Mailing List, Patch
git.kernel.org/stable/c/8f905c0e7354ef261360fb7535ea079b1082c105 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Exploit, Mailing List, Patch
git.kernel.org/stable/c/0249a4b8a554f2eb6a27b62516fa50168584faa4 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Exploit, Mailing List, Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report