CVE-2021-47136

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: zero-initialize tc skb extension on allocation

Function skb_ext_add() doesn't initialize created skb extension with any

value and leaves it up to the user. However, since extension of type

TC_SKB_EXT originally contained only single value tc_skb_ext->chain its

users used to just assign the chain value without setting whole extension

memory to zero first. This assumption changed when TC_SKB_EXT extension was

extended with additional fields but not all users were updated to

initialize the new fields which leads to use of uninitialized memory

afterwards. UBSAN log:

[ 778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28

[ 778.301495] load of value 107 is not a valid value for type '_Bool'

[ 778.303215] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc7+ #2

[ 778.304933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014

[ 778.307901] C

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References