{"id":"CVE-2021-47309","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: validate lwtstate-\u003edata before returning from skb_tunnel_info()\n\nskb_tunnel_info() returns pointer of lwtstate-\u003edata as ip_tunnel_info\ntype without validation. lwtstate-\u003edata can have various types such as\nmpls_iptunnel_encap, etc and these are not compatible.\nSo skb_tunnel_info() should validate before returning that pointer.\n\nSplat looks like:\nBUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan]\nRead of size 2 at addr ffff888106ec2698 by task ping/811\n\nCPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195\nCall Trace:\n dump_stack_lvl+0x56/0x7b\n print_address_description.constprop.8.cold.13+0x13/0x2ee\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n kasan_report.cold.14+0x83/0xdf\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n vxlan_get_route+0x418/0x4b0 [vxlan]\n [ ... ]\n vxlan_xmit_one+0x148b/0x32b0 [vxlan]\n [ ... ]\n vxlan_xmit+0x25c5/0x4780 [vxlan]\n [ ... ]\n dev_hard_start_xmit+0x1ae/0x6e0\n __dev_queue_xmit+0x1f39/0x31a0\n [ ... ]\n neigh_xmit+0x2f9/0x940\n mpls_xmit+0x911/0x1600 [mpls_iptunnel]\n lwtunnel_xmit+0x18f/0x450\n ip_finish_output2+0x867/0x2040\n [ ... ]","modified":"2026-03-13T05:20:41.898306Z","published":"2024-05-21T15:15:18.453Z","related":["SUSE-SU-2024:2360-1","SUSE-SU-2024:2381-1","SUSE-SU-2024:2561-1"],"references":[{"type":"FIX","url":"https://git.kernel.org/stable/c/8aa13a86964cdec4fd969ef677c6614ff068641a"},{"type":"FIX","url":"https://git.kernel.org/stable/c/8bb1589c89e61e3b182dd546f1021928ebb5c2a6"},{"type":"FIX","url":"https://git.kernel.org/stable/c/a915379594f1e045421635c6316d8f3ffa018c58"},{"type":"FIX","url":"https://git.kernel.org/stable/c/b61d327cd3cc5ea591f3bf751dd11e034f388bb5"},{"type":"FIX","url":"https://git.kernel.org/stable/c/e7f3c9df40515a6c6b46f36c4c94cf48a043f887"},{"type":"FIX","url":"https://git.kernel.org/stable/c/2179d96ec702cc33ead02a9ce40ece599b8538c5"},{"type":"FIX","url":"https://git.kernel.org/stable/c/67a9c94317402b826fc3db32afc8f39336803d97"},{"type":"FIX","url":"https://git.kernel.org/stable/c/83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d"}],"affected":[{"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"4.3"},{"fixed":"4.4.277"}]},{"events":[{"introduced":"4.5"},{"fixed":"4.9.277"}]},{"events":[{"introduced":"4.10"},{"fixed":"4.14.241"}]},{"events":[{"introduced":"4.15"},{"fixed":"4.19.199"}]},{"events":[{"introduced":"4.20"},{"fixed":"5.4.135"}]},{"events":[{"introduced":"5.5"},{"fixed":"5.10.53"}]},{"events":[{"introduced":"5.11"},{"fixed":"5.13.5"}]},{"events":[{"introduced":"0"},{"last_affected":"5.14-rc1"}]}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-47309.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}