{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47137","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-03-04T18:12:48.841Z","datePublished":"2024-03-25T09:07:36.778Z","dateUpdated":"2026-08-05T08:46:17.530Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:46:17.530Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lantiq: fix memory corruption in RX ring\n\nIn a situation where memory allocation or dma mapping fails, an\ninvalid address is programmed into the descriptor. This can lead\nto memory corruption. If the memory allocation fails, DMA should\nreuse the previous skb and mapping and drop the packet. This patch\nalso increments rx drop counter."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached from the XRX200 PMAC receive path (DMA IRQ → NAPI → xrx200_poll_rx → xrx200_hw_receive → xrx200_alloc_skb) while processing inbound frames; on typical VRX200 gateway deployments this CPU port handles WAN/LAN switch traffic, so a remote peer can trigger it by sending packets.\nAC:L - An attacker can flood traffic to induce memory pressure on constrained VRX200 routers so netdev_alloc_skb or dma_map_single fails during RX refill; once that happens the invalid-descriptor/UAF or NULL-deref path is deterministic, and under the uncertainty rule allocation/mapping failure is treated as low complexity.\nPR:N - No local account or capability is required; any host that can deliver frames to the interface causes RX ring refill with no authentication gate on this path.\nUI:N - Exploitation requires only attacker-sent packets; no victim action such as mounting a filesystem or opening a device is needed.\nS:U - Corruption and crashes occur in the host kernel’s ethernet driver/DMA path within the same security authority; this is not a VM escape or IOMMU/sandbox boundary crossing.\nC:H - On DMA mapping failure the driver programs DMA_MAPPING_ERROR into the RX descriptor and frees the new skb while leaving a dangling ring pointer, yielding a use-after-free plus DMA of attacker-controlled packet bytes to an invalid address—memory corruption that can be leveraged for kernel information disclosure.\nI:H - Programming an invalid RX DMA address lets hardware write attacker-controlled frame contents into unintended memory, and the dangling freed skb pointer is a classic UAF write/control-flow primitive under kernel memory-corruption guidance.\nA:H - Failed refill leaves a NULL or dangling skb in the RX ring so a subsequent packet causes NULL deref/UAF oops, and invalid DMA addresses can bus-error or panic the kernel, fully denying availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/lantiq_xrx200.c"],"versions":[{"version":"fe1a56420cf2ec28c8eceef672b87de0bbe1a260","lessThan":"8bb1077448d43a871ed667520763e3b9f9b7975d","status":"affected","versionType":"git"},{"version":"fe1a56420cf2ec28c8eceef672b87de0bbe1a260","lessThan":"5ac72351655f8b033a2935646f53b7465c903418","status":"affected","versionType":"git"},{"version":"fe1a56420cf2ec28c8eceef672b87de0bbe1a260","lessThan":"46dd4abced3cb2c912916f4a5353e0927db0c4a2","status":"affected","versionType":"git"},{"version":"fe1a56420cf2ec28c8eceef672b87de0bbe1a260","lessThan":"c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/lantiq_xrx200.c"],"versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","status":"unaffected","versionType":"semver"},{"version":"5.4.124","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.42","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.12.9","lessThanOrEqual":"5.12.*","status":"unaffected","versionType":"semver"},{"version":"5.13","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.4.124"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.10.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.12.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.13"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d"},{"url":"https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418"},{"url":"https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2"},{"url":"https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20"}],"title":"net: lantiq: fix memory corruption in RX ring","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-770","lang":"en","description":"CWE-770 Allocation of Resources Without Limits or Throttling"}]}],"affected":[{"vendor":"linux","product":"linux_kernel","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"fe1a56420cf2","status":"affected","lessThan":"8bb1077448d4","versionType":"git"},{"version":"fe1a56420cf2","status":"affected","lessThan":"5ac72351655f","versionType":"git"},{"version":"fe1a56420cf2","status":"affected","lessThan":"46dd4abced3c","versionType":"git"},{"version":"fe1a56420cf2","status":"affected","lessThan":"c7718ee96dbc","versionType":"git"},{"version":"4.20","status":"affected"},{"version":"0","status":"affected","lessThanOrEqual":"4.20","versionType":"semver"},{"version":"5.4.124","status":"affected","lessThanOrEqual":"5.4*","versionType":"semver"},{"version":"5.10.42","status":"affected","lessThanOrEqual":"5.10*","versionType":"semver"},{"version":"5.12.9","status":"affected","lessThanOrEqual":"5.12*","versionType":"semver"},{"version":"5.13","status":"affected","lessThanOrEqual":"*","versionType":"semver"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-03-25T17:15:32.931685Z","id":"CVE-2021-47137","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-11-05T16:22:44.933Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T05:24:39.977Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/8bb1077448d43a871ed667520763e3b9f9b7975d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/5ac72351655f8b033a2935646f53b7465c903418","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/46dd4abced3cb2c912916f4a5353e0927db0c4a2","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c7718ee96dbc2f9c5fc3b578abdf296dd44b9c20","tags":["x_transferred"]}]}]}}