{"id":"CVE-2021-47243","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsch_cake: Fix out of bounds when parsing TCP options and header\n\nThe TCP option parser in cake qdisc (cake_get_tcpopt and\ncake_tcph_may_drop) could read one byte out of bounds. When the length\nis 1, the execution flow gets into the loop, reads one byte of the\nopcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads\none more byte, which exceeds the length of 1.\n\nThis fix is inspired by commit 9609dad263f8 (\"ipv4: tcp_input: fix stack\nout of bounds when parsing TCP options.\").\n\nv2 changes:\n\nAdded doff validation in cake_get_tcphdr to avoid parsing garbage as TCP\nheader. Although it wasn't strictly an out-of-bounds access (memory was\nallocated), garbage values could be read where CAKE expected the TCP\nheader if doff was smaller than 5.","modified":"2026-03-15T22:43:09.018456Z","published":"2024-05-21T15:15:13.403Z","references":[{"type":"FIX","url":"https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f"},{"type":"FIX","url":"https://git.kernel.org/stable/c/3b491dd593d582ceeb27aa617600712a6bd14246"},{"type":"FIX","url":"https://git.kernel.org/stable/c/4cefa061fc63f4d2dff5ab4083f43857cd7a2335"},{"type":"FIX","url":"https://git.kernel.org/stable/c/595897ef118d6fe66690c4fc5b572028c9da95b7"},{"type":"FIX","url":"https://git.kernel.org/stable/c/ba91c49dedbde758ba0b72f57ac90b06ddf8e548"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47243.json","unresolved_ranges":[{"events":[{"introduced":"4.19"},{"fixed":"4.19.196"}]},{"events":[{"introduced":"4.20"},{"fixed":"5.4.128"}]},{"events":[{"introduced":"5.5"},{"fixed":"5.10.46"}]},{"events":[{"introduced":"5.11"},{"fixed":"5.12.13"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc1"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc2"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc3"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc4"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc5"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc6"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}