CVE-2021-47175 in Linux
Summary
by MITRE • 03/25/2024
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fq_pie: fix OOB access in the traffic path
the following script:
# tc qdisc add dev eth0 handle 0x1 root fq_pie flows 2 # tc qdisc add dev eth0 clsact # tc filter add dev eth0 egress matchall action skbedit priority 0x10002 # ping 192.0.2.2 -I eth0 -c2 -w1 -q
produces the following splat:
BUG: KASAN: slab-out-of-bounds in fq_pie_qdisc_enqueue+0x1314/0x19d0 [sch_fq_pie]
Read of size 4 at addr ffff888171306924 by task ping/942
CPU: 3 PID: 942 Comm: ping Not tainted 5.12.0+ #441 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 fq_pie_qdisc_enqueue+0x1314/0x19d0 [sch_fq_pie]
__dev_queue_xmit+0x1034/0x2b10 ip_finish_output2+0xc62/0x2120 __ip_finish_output+0x553/0xea0 ip_output+0x1ca/0x4d0 ip_send_skb+0x37/0xa0 raw_sendmsg+0x1c4b/0x2d00 sock_sendmsg+0xdb/0x110 __sys_sendto+0x1d7/0x2b0 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fe69735c3eb Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 75 42 2c 00 41 89 ca 8b 00 85 c0 75 14 b8 2c 00 00 00 0f 05 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 41 57 4d 89 c7 41 56 41 89 RSP: 002b:00007fff06d7fb38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055e961413700 RCX: 00007fe69735c3eb RDX: 0000000000000040 RSI: 000055e961413700 RDI: 0000000000000003 RBP: 0000000000000040 R08: 000055e961410500 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff06d81260 R13: 00007fff06d7fb40 R14: 00007fff06d7fc30 R15: 000055e96140f0a0
Allocated by task 917: kasan_save_stack+0x19/0x40 __kasan_kmalloc+0x7f/0xa0 __kmalloc_node+0x139/0x280 fq_pie_init+0x555/0x8e8 [sch_fq_pie]
qdisc_create+0x407/0x11b0 tc_modify_qdisc+0x3c2/0x17e0 rtnetlink_rcv_msg+0x346/0x8e0 netlink_rcv_skb+0x120/0x380 netlink_unicast+0x439/0x630 netlink_sendmsg+0x719/0xbf0 sock_sendmsg+0xe2/0x110 ____sys_sendmsg+0x5ba/0x890 ___sys_sendmsg+0xe9/0x160 __sys_sendmsg+0xd3/0x170 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff888171306800 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 36 bytes to the right of 256-byte region [ffff888171306800, ffff888171306900)
The buggy address belongs to the page: page:00000000bcfb624e refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x171306 head:00000000bcfb624e order:1 compound_mapcount:0 flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0010200 dead000000000100 dead000000000122 ffff888100042b40 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffff888171306800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888171306880: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc >ffff888171306900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888171306980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888171306a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fix fq_pie traffic path to avoid selecting 'q->flows + q->flows_cnt' as a valid flow: it's an address beyond the allocated memory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/04/2025
The vulnerability CVE-2021-47175 represents a critical out-of-bounds memory access flaw within the Linux kernel's fq_pie traffic control qdisc implementation. This issue occurs in the network scheduling subsystem where the fq_pie (fair queue pie) qdisc is used to manage packet queuing and scheduling. The flaw manifests when specific traffic control configurations are applied using the tc command utility, creating a scenario where memory access violations occur during packet processing. The vulnerability is classified as a slab-out-of-bounds error by the kernel's KASAN (Kernel Address Sanitizer) subsystem, indicating that the kernel is attempting to access memory beyond the boundaries of allocated kernel memory structures. This type of vulnerability falls under CWE-121, which describes heap-based buffer overflow conditions, and aligns with ATT&CK technique T1059.006 for kernel-mode exploitation. The vulnerability specifically affects the fq_pie_qdisc_enqueue function where the kernel attempts to access memory at an address that extends beyond the allocated 256-byte memory region, causing a memory access violation that can lead to system instability or potential privilege escalation.
The technical implementation of this vulnerability stems from improper bounds checking within the fq_pie qdisc logic when handling flow selection during packet enqueue operations. The kernel allocates memory for flow tracking structures but fails to validate that the selected flow index does not exceed the allocated memory boundaries. The memory layout shows that the allocated kmalloc-256 cache region spans from address ffff888171306800 to ffff888171306900, yet the buggy code attempts to access memory at offset 36 bytes beyond this region, specifically at address ffff888171306924. This occurs when the code incorrectly calculates or selects a flow index that equals q->flows + q->flows_cnt, which represents an address located outside the allocated memory space. The root cause lies in the traffic control configuration where multiple qdiscs are applied to the same network interface, creating a complex interaction that triggers this memory access violation. The attack vector requires specific tc command sequences that configure both fq_pie and clsact qdiscs along with matchall filters, making this a targeted issue that requires specific network configuration to exploit.
The operational impact of CVE-2021-47175 extends beyond simple system crashes, as this vulnerability can potentially be exploited to achieve privilege escalation or denial-of-service conditions. When the kernel encounters this out-of-bounds access, it triggers a kernel panic or system crash, resulting in immediate disruption of network services on affected systems. The vulnerability affects systems running Linux kernel versions that include the fq_pie qdisc implementation, particularly those using traffic control configurations with multiple qdiscs. The memory corruption can lead to unpredictable behavior including data corruption, system instability, and potential information disclosure. Systems utilizing complex network traffic management policies or those implementing advanced quality of service configurations are at higher risk. The vulnerability's exploitation requires specific network conditions and traffic control setup, making it less likely to be exploited in the wild but still poses a significant risk to systems that implement the affected configurations. Organizations running network infrastructure with tc-based traffic control policies should prioritize patching to prevent potential exploitation.
Mitigation strategies for CVE-2021-47175 focus on applying the kernel security patch that resolves the out-of-bounds memory access issue within the fq_pie qdisc implementation. The fix involves modifying the flow selection logic to ensure that indices used for accessing flow structures remain within the allocated memory boundaries, preventing the calculation of invalid memory addresses that exceed the q->flows + q->flows_cnt boundary. System administrators should update to kernel versions containing the patched implementation, typically kernel 5.12 or later, where the vulnerability has been addressed. Additionally, organizations should review and simplify their traffic control configurations to avoid complex interactions between multiple qdiscs that could trigger the vulnerability. Network administrators should monitor for any system instability or crashes that might indicate exploitation attempts. The patch implementation specifically addresses the memory access pattern that occurs when selecting flow indices and ensures that the flow selection algorithm bounds checks all calculated indices against the actual memory allocation limits. This fix aligns with security best practices for kernel memory management and prevents the type of out-of-bounds access that could be leveraged for privilege escalation or system compromise. Organizations should also consider implementing network segmentation and monitoring to detect anomalous traffic control configurations that might inadvertently trigger this vulnerability.