GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47496 (GCVE-0-2021-47496)

Vulnerability from cvelistv5 – Published: 2024-05-22 08:19 – Updated: 2026-08-05 08:48
VLAI
Title
net/tls: Fix flipped sign in tls_err_abort() calls
Summary
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix flipped sign in tls_err_abort() calls sk->sk_err appears to expect a positive value, a convention that ktls doesn't always follow and that leads to memory corruption in other code. For instance, [kworker] tls_encrypt_done(..., err=<negative error from crypto request>) tls_err_abort(.., err) sk->sk_err = err; [task] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk->sk_err) { ret = -sk->sk_err; // ret is positive splice_from_pipe_feed (continued) ret = actor(...) // ret is still positive and interpreted as bytes // written, resulting in underflow of buf->len and // sd->len, leading to huge buf->offset and bogus // addresses computed in later calls to actor() Fix all tls_err_abort() callers to pass a negative error code consistently and centralize the error-prone sign flip there, throwing in a warning to catch future misuse and uninlining the function so it really does only warn once.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:35 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c46234ebb4d1eee5e09819f49169e51cfc6eb909 , < e0cfd5159f314d6b304d030363650b06a2299cbb (git)
Affected: c46234ebb4d1eee5e09819f49169e51cfc6eb909 , < f3dec7e7ace38224f82cf83f0049159d067c2e19 (git)
Affected: c46234ebb4d1eee5e09819f49169e51cfc6eb909 , < e41473543f75f7dbc5d605007e6f883f1bd13b9a (git)
Affected: c46234ebb4d1eee5e09819f49169e51cfc6eb909 , < da353fac65fede6b8b4cfe207f0d9408e3121105 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.4.157 , ≤ 5.4.* (semver)
Unaffected: 5.10.77 , ≤ 5.10.* (semver)
Unaffected: 5.14.16 , ≤ 5.14.* (semver)
Unaffected: 5.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.752Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47496",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:35:52.280096Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:23.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/tls.h",
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e0cfd5159f314d6b304d030363650b06a2299cbb",
              "status": "affected",
              "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
              "versionType": "git"
            },
            {
              "lessThan": "f3dec7e7ace38224f82cf83f0049159d067c2e19",
              "status": "affected",
              "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
              "versionType": "git"
            },
            {
              "lessThan": "e41473543f75f7dbc5d605007e6f883f1bd13b9a",
              "status": "affected",
              "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
              "versionType": "git"
            },
            {
              "lessThan": "da353fac65fede6b8b4cfe207f0d9408e3121105",
              "status": "affected",
              "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/tls.h",
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.157",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.77",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.16",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: Fix flipped sign in tls_err_abort() calls\n\nsk-\u003esk_err appears to expect a positive value, a convention that ktls\ndoesn\u0027t always follow and that leads to memory corruption in other code.\nFor instance,\n\n    [kworker]\n    tls_encrypt_done(..., err=\u003cnegative error from crypto request\u003e)\n      tls_err_abort(.., err)\n        sk-\u003esk_err = err;\n\n    [task]\n    splice_from_pipe_feed\n      ...\n        tls_sw_do_sendpage\n          if (sk-\u003esk_err) {\n            ret = -sk-\u003esk_err;  // ret is positive\n\n    splice_from_pipe_feed (continued)\n      ret = actor(...)  // ret is still positive and interpreted as bytes\n                        // written, resulting in underflow of buf-\u003elen and\n                        // sd-\u003elen, leading to huge buf-\u003eoffset and bogus\n                        // addresses computed in later calls to actor()\n\nFix all tls_err_abort() callers to pass a negative error code\nconsistently and centralize the error-prone sign flip there, throwing in\na warning to catch future misuse and uninlining the function so it\nreally does only warn once."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in kTLS (net/tls): a remote peer of a kTLS-offloaded service can set a negative sk_err via tls_read_size()/tls_decrypt_done() by sending a malformed TLS record, then the server\u2019s ordinary sendfile/splice TX path (tls_sw_do_sendpage) mis-handles that sk_err; per guidance, kTLS bugs driven by remote peer data are Network.\nAC:L - The attacker fully controls the malformed TLS records and can send them while the server is mid-sendfile/splice (or retry across connections); no race or memory-layout condition outside attacker influence is required for the sign-flip corruption.\nPR:N - An unauthenticated client of a public kTLS HTTPS/TLS service needs no account or capability on the host; setsockopt(TCP_ULP,\"tls\")/TLS_TX|RX also requires no capability once the tls module is loaded.\nUI:N - Exploitation needs only the attacker\u2019s TLS traffic plus the server\u2019s normal sendfile/splice response path; no separate victim user or administrator action is required.\nS:U - The pipe-buffer underflow and resulting UAF/OOB access corrupt kernel memory within the same host kernel authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - splice_from_pipe_feed underflows buf-\u003elen and advances buf-\u003eoffset into bogus addresses, and syzbot observed a KASAN use-after-free read in __crypto_xor; that memory-corruption/UAF primitive is leverageable for arbitrary kernel disclosure.\nI:H - The same underflow drives later actor()/sendpage calls with huge offsets into reclaimed or adjacent memory, yielding OOB write and UAF write primitives that can be escalated to control-flow hijack.\nA:H - The resulting use-after-free and out-of-bounds accesses reliably oops/panic the kernel (as in the syzbot KASAN report), fully disrupting availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:05.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19"
        },
        {
          "url": "https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105"
        }
      ],
      "title": "net/tls: Fix flipped sign in tls_err_abort() calls",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47496",
    "datePublished": "2024-05-22T08:19:43.489Z",
    "dateReserved": "2024-05-22T06:20:56.202Z",
    "dateUpdated": "2026-08-05T08:48:05.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47496",
      "date": "2026-09-19",
      "epss": "0.00483",
      "percentile": "0.40775"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: Fix flipped sign in tls_err_abort() calls\n\nsk-\u003esk_err appears to expect a positive value, a convention that ktls\ndoesn\u0027t always follow and that leads to memory corruption in other code.\nFor instance,\n\n    [kworker]\n    tls_encrypt_done(..., err=\u003cnegative error from crypto request\u003e)\n      tls_err_abort(.., err)\n        sk-\u003esk_err = err;\n\n    [task]\n    splice_from_pipe_feed\n      ...\n        tls_sw_do_sendpage\n          if (sk-\u003esk_err) {\n            ret = -sk-\u003esk_err;  // ret is positive\n\n    splice_from_pipe_feed (continued)\n      ret = actor(...)  // ret is still positive and interpreted as bytes\n                        // written, resulting in underflow of buf-\u003elen and\n                        // sd-\u003elen, leading to huge buf-\u003eoffset and bogus\n                        // addresses computed in later calls to actor()\n\nFix all tls_err_abort() callers to pass a negative error code\nconsistently and centralize the error-prone sign flip there, throwing in\na warning to catch future misuse and uninlining the function so it\nreally does only warn once."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/tls: corrige las llamadas invertidas de tls_err_abort() sk-\u0026gt;sk_err parece esperar un valor positivo, una convenci\u00f3n que ktls no siempre sigue y que conduce a da\u00f1os en la memoria en otro c\u00f3digo. Por ejemplo, [kworker] tls_encrypt_done(..., err=) tls_err_abort(.., err) sk-\u0026gt;sk_err = err; [tarea] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk-\u0026gt;sk_err) { ret = -sk-\u0026gt;sk_err; // ret es positivo splice_from_pipe_feed (continuaci\u00f3n) ret = actor(...) // ret sigue siendo positivo y se interpreta como bytes // escritos, lo que resulta en un desbordamiento insuficiente de buf-\u0026gt;len y // sd-\u0026gt;len, lo que genera enormes buf-\u0026gt;offset y bogus // direcciones calculadas en llamadas posteriores a actor(). Repare todas las llamadas tls_err_abort() para que pasen un c\u00f3digo de error negativo de manera consistente y centralice el cambio de se\u00f1al propenso a errores all\u00ed, lanzando una advertencia para detectar futuros usos indebidos y eliminaci\u00f3n de l\u00edneas. la funci\u00f3n por lo que realmente solo advierte una vez."
        }
      ],
      "id": "CVE-2021-47496",
      "lastModified": "2024-11-21T06:36:20.093",
      "published": "2024-05-22T09:15:11.447",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/tls.h",
                  "net/tls/tls_sw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e0cfd5159f314d6b304d030363650b06a2299cbb",
                    "status": "affected",
                    "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f3dec7e7ace38224f82cf83f0049159d067c2e19",
                    "status": "affected",
                    "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e41473543f75f7dbc5d605007e6f883f1bd13b9a",
                    "status": "affected",
                    "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "da353fac65fede6b8b4cfe207f0d9408e3121105",
                    "status": "affected",
                    "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/tls.h",
                  "net/tls/tls_sw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.17"
                  },
                  {
                    "lessThan": "4.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.77",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.14.*",
                    "status": "unaffected",
                    "version": "5.14.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "965296D4-AA37-4DB2-9ED7-71310E9A6C11",
                    "versionEndExcluding": "5.4.157",
                    "versionStartIncluding": "4.17",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26EB7ED9-AEA3-4829-8B5E-08571262F72A",
                    "versionEndExcluding": "5.10.77",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2681B950-4548-4649-A9E1-4124B59FC09C",
                    "versionEndExcluding": "5.14.16",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E46C74C6-B76B-4C94-A6A4-FD2FFF62D644",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "60134C3A-06E4-48C1-B04F-2903732A4E56",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "0460DA88-8FE1-46A2-9DDA-1F1ABA552E71",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "AF55383D-4DF2-45DC-93F7-571F4F978EAB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "EBD45831-4B79-42BC-ABC0-86870F0DEA89",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "948A6B8D-1B72-4945-8680-354E53BE1C80",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: Fix flipped sign in tls_err_abort() calls\n\nsk-\u003esk_err appears to expect a positive value, a convention that ktls\ndoesn\u0027t always follow and that leads to memory corruption in other code.\nFor instance,\n\n    [kworker]\n    tls_encrypt_done(..., err=\u003cnegative error from crypto request\u003e)\n      tls_err_abort(.., err)\n        sk-\u003esk_err = err;\n\n    [task]\n    splice_from_pipe_feed\n      ...\n        tls_sw_do_sendpage\n          if (sk-\u003esk_err) {\n            ret = -sk-\u003esk_err;  // ret is positive\n\n    splice_from_pipe_feed (continued)\n      ret = actor(...)  // ret is still positive and interpreted as bytes\n                        // written, resulting in underflow of buf-\u003elen and\n                        // sd-\u003elen, leading to huge buf-\u003eoffset and bogus\n                        // addresses computed in later calls to actor()\n\nFix all tls_err_abort() callers to pass a negative error code\nconsistently and centralize the error-prone sign flip there, throwing in\na warning to catch future misuse and uninlining the function so it\nreally does only warn once."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/tls: corrige las llamadas invertidas de tls_err_abort() sk-\u0026gt;sk_err parece esperar un valor positivo, una convenci\u00f3n que ktls no siempre sigue y que conduce a da\u00f1os en la memoria en otro c\u00f3digo. Por ejemplo, [kworker] tls_encrypt_done(..., err=) tls_err_abort(.., err) sk-\u0026gt;sk_err = err; [tarea] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk-\u0026gt;sk_err) { ret = -sk-\u0026gt;sk_err; // ret es positivo splice_from_pipe_feed (continuaci\u00f3n) ret = actor(...) // ret sigue siendo positivo y se interpreta como bytes // escritos, lo que resulta en un desbordamiento insuficiente de buf-\u0026gt;len y // sd-\u0026gt;len, lo que genera enormes buf-\u0026gt;offset y bogus // direcciones calculadas en llamadas posteriores a actor(). Repare todas las llamadas tls_err_abort() para que pasen un c\u00f3digo de error negativo de manera consistente y centralice el cambio de se\u00f1al propenso a errores all\u00ed, lanzando una advertencia para detectar futuros usos indebidos y eliminaci\u00f3n de l\u00edneas. la funci\u00f3n por lo que realmente solo advierte una vez."
          }
        ],
        "id": "CVE-2021-47496",
        "lastModified": "2026-08-04T10:17:05.910",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47496",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:35:52.280096Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-22T09:15:11.447",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:02:27+00:00",
      "cve": "CVE-2021-47496",
      "id": "CVE-2021-47496",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "48",
      "product_status:known_not_affected": "150",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/tls: Fix flipped sign in tls_err_abort() calls",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47496.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T02:37:45Z",
      "cve": "CVE-2021-47496",
      "id": "CVE-2021-47496",
      "initial_release_date": "2024-05-28T03:33:05Z",
      "product_status:known_affected": "302",
      "product_status:known_not_affected": "169",
      "product_status:recommended": "668",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47496",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47496.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:39:59.752Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47496",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:35:52.280096Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:16.475Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "include/net/tls.h",
                "net/tls/tls_sw.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "e0cfd5159f314d6b304d030363650b06a2299cbb",
                  "status": "affected",
                  "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
                  "versionType": "git"
                },
                {
                  "lessThan": "f3dec7e7ace38224f82cf83f0049159d067c2e19",
                  "status": "affected",
                  "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
                  "versionType": "git"
                },
                {
                  "lessThan": "e41473543f75f7dbc5d605007e6f883f1bd13b9a",
                  "status": "affected",
                  "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
                  "versionType": "git"
                },
                {
                  "lessThan": "da353fac65fede6b8b4cfe207f0d9408e3121105",
                  "status": "affected",
                  "version": "c46234ebb4d1eee5e09819f49169e51cfc6eb909",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "include/net/tls.h",
                "net/tls/tls_sw.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.17"
                },
                {
                  "lessThan": "4.17",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.157",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.77",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.14.*",
                  "status": "unaffected",
                  "version": "5.14.16",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.15",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.157",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.77",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.14.16",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: Fix flipped sign in tls_err_abort() calls\n\nsk-\u003esk_err appears to expect a positive value, a convention that ktls\ndoesn\u0027t always follow and that leads to memory corruption in other code.\nFor instance,\n\n    [kworker]\n    tls_encrypt_done(..., err=\u003cnegative error from crypto request\u003e)\n      tls_err_abort(.., err)\n        sk-\u003esk_err = err;\n\n    [task]\n    splice_from_pipe_feed\n      ...\n        tls_sw_do_sendpage\n          if (sk-\u003esk_err) {\n            ret = -sk-\u003esk_err;  // ret is positive\n\n    splice_from_pipe_feed (continued)\n      ret = actor(...)  // ret is still positive and interpreted as bytes\n                        // written, resulting in underflow of buf-\u003elen and\n                        // sd-\u003elen, leading to huge buf-\u003eoffset and bogus\n                        // addresses computed in later calls to actor()\n\nFix all tls_err_abort() callers to pass a negative error code\nconsistently and centralize the error-prone sign flip there, throwing in\na warning to catch future misuse and uninlining the function so it\nreally does only warn once."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The bug is in kTLS (net/tls): a remote peer of a kTLS-offloaded service can set a negative sk_err via tls_read_size()/tls_decrypt_done() by sending a malformed TLS record, then the server\u2019s ordinary sendfile/splice TX path (tls_sw_do_sendpage) mis-handles that sk_err; per guidance, kTLS bugs driven by remote peer data are Network.\nAC:L - The attacker fully controls the malformed TLS records and can send them while the server is mid-sendfile/splice (or retry across connections); no race or memory-layout condition outside attacker influence is required for the sign-flip corruption.\nPR:N - An unauthenticated client of a public kTLS HTTPS/TLS service needs no account or capability on the host; setsockopt(TCP_ULP,\"tls\")/TLS_TX|RX also requires no capability once the tls module is loaded.\nUI:N - Exploitation needs only the attacker\u2019s TLS traffic plus the server\u2019s normal sendfile/splice response path; no separate victim user or administrator action is required.\nS:U - The pipe-buffer underflow and resulting UAF/OOB access corrupt kernel memory within the same host kernel authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - splice_from_pipe_feed underflows buf-\u003elen and advances buf-\u003eoffset into bogus addresses, and syzbot observed a KASAN use-after-free read in __crypto_xor; that memory-corruption/UAF primitive is leverageable for arbitrary kernel disclosure.\nI:H - The same underflow drives later actor()/sendpage calls with huge offsets into reclaimed or adjacent memory, yielding OOB write and UAF write primitives that can be escalated to control-flow hijack.\nA:H - The resulting use-after-free and out-of-bounds accesses reliably oops/panic the kernel (as in the syzbot KASAN report), fully disrupting availability."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:48:05.957Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb"
            },
            {
              "url": "https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19"
            },
            {
              "url": "https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a"
            },
            {
              "url": "https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105"
            }
          ],
          "title": "net/tls: Fix flipped sign in tls_err_abort() calls",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47496",
        "datePublished": "2024-05-22T08:19:43.489Z",
        "dateReserved": "2024-05-22T06:20:56.202Z",
        "dateUpdated": "2026-08-05T08:48:05.957Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.