cve/published/2021/CVE-2021-47363.json

{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Fix division by zero while replacing a resilient group\n\nThe resilient nexthop group torture tests in fib_nexthop.sh exposed a\npossible division by zero while replacing a resilient group [1]. The\ndivision by zero occurs when the data path sees a resilient nexthop\ngroup with zero buckets.\n\nThe tests replace a resilient nexthop group in a loop while traffic is\nforwarded through it. The tests do not specify the number of buckets\nwhile performing the replacement, resulting in the kernel allocating a\nstub resilient table (i.e, 'struct nh_res_table') with zero buckets.\n\nThis table should never be visible to the data path, but the old nexthop\ngroup (i.e., 'oldg') might still be used by the data path when the stub\ntable is assigned to it.\n\nFix this by only assigning the stub table to the old nexthop group after\nmaking sure the group is no longer used by the data path.\n\nTested with fib_nexthops.sh:\n\nTests passed: 222\nTests failed:   0\n\n[1]\n divide error: 0000 [#1] PREEMPT SMP KASAN\n CPU: 0 PID: 1850 Comm: ping Not tainted 5.14.0-custom-10271-ga86eb53057fe #1107\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014\n RIP: 0010:nexthop_select_path+0x2d2/0x1a80\n[...]\n Call Trace:\n  fib_select_multipath+0x79b/0x1530\n  fib_select_path+0x8fb/0x1c10\n  ip_route_output_key_hash_rcu+0x1198/0x2da0\n  ip_route_output_key_hash+0x190/0x340\n  ip_route_output_flow+0x21/0x120\n  raw_sendmsg+0x91d/0x2e10\n  inet_sendmsg+0x9e/0xe0\n  __sys_sendto+0x23d/0x360\n  __x64_sys_sendto+0xe1/0x1b0\n  do_syscall_64+0x35/0x80\n  entry_SYSCALL_64_after_hwframe+0x44/0xae"
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "net/ipv4/nexthop.c"
               ],
               "versions": [
                  {
                     "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
                     "lessThan": "e9d32ec26e7f01d1af13bdc687f586362546aa25",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
                     "lessThan": "563f23b002534176f49524b5ca0e1d94d8906c40",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "net/ipv4/nexthop.c"
               ],
               "versions": [
                  {
                     "version": "5.13",
                     "status": "affected"
                  },
                  {
                     "version": "0",
                     "lessThan": "5.13",
                     "status": "unaffected",
                     "versionType": "semver"
                  },
                  {
                     "version": "5.14.9",
                     "lessThanOrEqual": "5.14.*",
                     "status": "unaffected",
                     "versionType": "semver"
                  },
                  {
                     "version": "5.15",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "cpeApplicability": [
            {
               "nodes": [
                  {
                     "operator": "OR",
                     "negate": false,
                     "cpeMatch": [
                        {
                           "vulnerable": true,
                           "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           "versionStartIncluding": "5.13",
                           "versionEndExcluding": "5.14.9"
                        },
                        {
                           "vulnerable": true,
                           "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           "versionStartIncluding": "5.13",
                           "versionEndExcluding": "5.15"
                        }
                     ]
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/e9d32ec26e7f01d1af13bdc687f586362546aa25"
            },
            {
               "url": "https://git.kernel.org/stable/c/563f23b002534176f49524b5ca0e1d94d8906c40"
            }
         ],
         "title": "nexthop: Fix division by zero while replacing a resilient group",
         "x_generator": {
            "engine": "bippy-1.2.0"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2021-47363",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}