CVE-2021-47397 sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
A null pointer dereference in the Linux kernel SCTP implementation allows remote attackers to cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47397?
CVE-2021-47397 is a high-severity vulnerability in Linux kernel, published on 21 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
We should always check if skb_header_pointer's return is NULL before using it, otherwise it may cause null-ptr-deref, as syzbot reported:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline] RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196 Call Trace: <IRQ> sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109 ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422 ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297
Weakness: CWE-476
Which versions are affected by CVE-2021-47397?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47397?
Apply the vendor's patch.
Is CVE-2021-47397 being exploited?
There is no known exploitation of CVE-2021-47397 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47397, GHSA-v8p3-mfrc-9v8j, UBUNTU-CVE-2021-47397.