{"id":"DEBIAN-CVE-2021-47515","details":"In the Linux kernel, the following vulnerability has been resolved:  seg6: fix the iif in the IPv6 socket control block  When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving interface index into the IPv4 socket control block (v5.16-rc4, net/ipv4/ip_input.c line 510):      IPCB(skb)-\u003eiif = skb-\u003eskb_iif;  If that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH header, the seg6_do_srh_encap(...) performs the required encapsulation. In this case, the seg6_do_srh_encap function clears the IPv6 socket control block (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163):      memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));  The memset(...) was introduced in commit ef489749aae5 (\"ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation\") a long time ago (2019-01-29).  Since the IPv6 socket control block and the IPv4 socket control block share the same memory area (skb-\u003ecb), the receiving interface index info is lost (IP6CB(skb)-\u003eiif is set to zero).  As a side effect, that condition triggers a NULL pointer dereference if commit 0857d6f8c759 (\"ipv6: When forwarding count rx stats on the orig netdev\") is applied.  To fix that issue, we set the IP6CB(skb)-\u003eiif with the index of the receiving interface once again.","modified":"2026-09-15T09:02:38.351171283Z","published":"2024-05-24T15:15:12.937Z","upstream":["CVE-2021-47515"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2021-47515"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.15-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47515.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.15-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47515.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.15-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47515.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}