DEBIAN-CVE-2021-47496
- Source
- https://security-tracker.debian.org/tracker/DEBIAN-CVE-2021-47496
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47496.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2021-47496
- Upstream
- Published
- 2024-05-22T09:15:11Z
- Modified
- 2025-09-18T06:23:22.762665Z
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix flipped sign in tlserrabort() calls sk->skerr appears to expect a positive value, a convention that ktls doesn't always follow and that leads to memory corruption in other code. For instance, [kworker] tlsencryptdone(..., err=<negative error from crypto request>) tlserrabort(.., err) sk->skerr = err; [task] splicefrompipefeed ... tlsswdosendpage if (sk->skerr) { ret = -sk->skerr; // ret is positive splicefrompipefeed (continued) ret = actor(...) // ret is still positive and interpreted as bytes // written, resulting in underflow of buf->len and // sd->len, leading to huge buf->offset and bogus // addresses computed in later calls to actor() Fix all tlserr_abort() callers to pass a negative error code consistently and centralize the error-prone sign flip there, throwing in a warning to catch future misuse and uninlining the function so it really does only warn once.
- References
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:14 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source