{"id":"DEBIAN-CVE-2021-47136","details":"In the Linux kernel, the following vulnerability has been resolved:  net: zero-initialize tc skb extension on allocation  Function skb_ext_add() doesn't initialize created skb extension with any value and leaves it up to the user. However, since extension of type TC_SKB_EXT originally contained only single value tc_skb_ext-\u003echain its users used to just assign the chain value without setting whole extension memory to zero first. This assumption changed when TC_SKB_EXT extension was extended with additional fields but not all users were updated to initialize the new fields which leads to use of uninitialized memory afterwards. UBSAN log:  [  778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28 [  778.301495] load of value 107 is not a valid value for type '_Bool' [  778.303215] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc7+ #2 [  778.304933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [  778.307901] Call Trace: [  778.308680]  \u003cIRQ\u003e [  778.309358]  dump_stack+0xbb/0x107 [  778.310307]  ubsan_epilogue+0x5/0x40 [  778.311167]  __ubsan_handle_load_invalid_value.cold+0x43/0x48 [  778.312454]  ? memset+0x20/0x40 [  778.313230]  ovs_flow_key_extract.cold+0xf/0x14 [openvswitch] [  778.314532]  ovs_vport_receive+0x19e/0x2e0 [openvswitch] [  778.315749]  ? ovs_vport_find_upcall_portid+0x330/0x330 [openvswitch] [  778.317188]  ? create_prof_cpu_mask+0x20/0x20 [  778.318220]  ? arch_stack_walk+0x82/0xf0 [  778.319153]  ? secondary_startup_64_no_verify+0xb0/0xbb [  778.320399]  ? stack_trace_save+0x91/0xc0 [  778.321362]  ? stack_trace_consume_entry+0x160/0x160 [  778.322517]  ? lock_release+0x52e/0x760 [  778.323444]  netdev_frame_hook+0x323/0x610 [openvswitch] [  778.324668]  ? ovs_netdev_get_vport+0xe0/0xe0 [openvswitch] [  778.325950]  __netif_receive_skb_core+0x771/0x2db0 [  778.327067]  ? lock_downgrade+0x6e0/0x6f0 [  778.328021]  ? lock_acquire+0x565/0x720 [  778.328940]  ? generic_xdp_tx+0x4f0/0x4f0 [  778.329902]  ? inet_gro_receive+0x2a7/0x10a0 [  778.330914]  ? lock_downgrade+0x6f0/0x6f0 [  778.331867]  ? udp4_gro_receive+0x4c4/0x13e0 [  778.332876]  ? lock_release+0x52e/0x760 [  778.333808]  ? dev_gro_receive+0xcc8/0x2380 [  778.334810]  ? lock_downgrade+0x6f0/0x6f0 [  778.335769]  __netif_receive_skb_list_core+0x295/0x820 [  778.336955]  ? process_backlog+0x780/0x780 [  778.337941]  ? mlx5e_rep_tc_netdevice_event_unregister+0x20/0x20 [mlx5_core] [  778.339613]  ? seqcount_lockdep_reader_access.constprop.0+0xa7/0xc0 [  778.341033]  ? kvm_clock_get_cycles+0x14/0x20 [  778.342072]  netif_receive_skb_list_internal+0x5f5/0xcb0 [  778.343288]  ? __kasan_kmalloc+0x7a/0x90 [  778.344234]  ? mlx5e_handle_rx_cqe_mpwrq+0x9e0/0x9e0 [mlx5_core] [  778.345676]  ? mlx5e_xmit_xdp_frame_mpwqe+0x14d0/0x14d0 [mlx5_core] [  778.347140]  ? __netif_receive_skb_list_core+0x820/0x820 [  778.348351]  ? mlx5e_post_rx_mpwqes+0xa6/0x25d0 [mlx5_core] [  778.349688]  ? napi_gro_flush+0x26c/0x3c0 [  778.350641]  napi_complete_done+0x188/0x6b0 [  778.351627]  mlx5e_napi_poll+0x373/0x1b80 [mlx5_core] [  778.352853]  __napi_poll+0x9f/0x510 [  778.353704]  ? mlx5_flow_namespace_set_mode+0x260/0x260 [mlx5_core] [  778.355158]  net_rx_action+0x34c/0xa40 [  778.356060]  ? napi_threaded_poll+0x3d0/0x3d0 [  778.357083]  ? sched_clock_cpu+0x18/0x190 [  778.358041]  ? __common_interrupt+0x8e/0x1a0 [  778.359045]  __do_softirq+0x1ce/0x984 [  778.359938]  __irq_exit_rcu+0x137/0x1d0 [  778.360865]  irq_exit_rcu+0xa/0x20 [  778.361708]  common_interrupt+0x80/0xa0 [  778.362640]  \u003c/IRQ\u003e [  778.363212]  asm_common_interrupt+0x1e/0x40 [  778.364204] RIP: 0010:native_safe_halt+0xe/0x10 [  778.365273] Code: 4f ff ff ff 4c 89 e7 e8 50 3f 40 fe e9 dc fe ff ff 48 89 df e8 43 3f 40 fe eb 90 cc e9 07 00 00 00 0f 00 2d 74 05 62 00 fb f4 \u003cc3\u003e 90 e9 07 00 00 00 0f 00 2d 64 05 62 00 f4 c3 cc cc 0f 1f 44 00 [  778.369355] RSP: 0018:ffffffff84407e48 EFLAGS: 00000246 [  778.370570] RAX ---truncated---","modified":"2026-09-01T20:04:36.839787797Z","published":"2024-03-25T09:15:07.970Z","upstream":["CVE-2021-47136"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2021-47136"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47136.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47136.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47136.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}