{"id":"DEBIAN-CVE-2021-47397","details":"In the Linux kernel, the following vulnerability has been resolved:  sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb  We should always check if skb_header_pointer's return is NULL before using it, otherwise it may cause null-ptr-deref, as syzbot reported:    KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]   RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline]   RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196   Call Trace:   \u003cIRQ\u003e    sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109    ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422    ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463    NF_HOOK include/linux/netfilter.h:307 [inline]    NF_HOOK include/linux/netfilter.h:301 [inline]    ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472    dst_input include/net/dst.h:460 [inline]    ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]    NF_HOOK include/linux/netfilter.h:307 [inline]    NF_HOOK include/linux/netfilter.h:301 [inline]    ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297","modified":"2026-09-15T09:02:39.951664844Z","published":"2024-05-21T15:15:25.017Z","upstream":["CVE-2021-47397"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2021-47397"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.12-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47397.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.12-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47397.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.12-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47397.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}