Skip to content
OpenAdvisories
Unscored CVE-2021-47250 EUVD-2021-33898GHSA-wr5g-85mp-25c9

net: ipv4: fix memory leak in netlbl_cipsov4_add_std

Published May 21, 2024 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.4 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-fips Package: linux-aws-hwe Package: linux-azure Package: linux-azure-4.15 Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.4 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-fips Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-4.15 Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.4 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.4 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-kvm Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lts-xenial Package: linux-nvidia-6.2 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.4 Package: linux-oracle-5.8 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-vmware Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: fix memory leak in netlbl_cipsov4_add_std

Reported by syzkaller:
BUG: memory leak
unreferenced object 0xffff888105df7000 (size 64):
comm "syz-executor842", pid 360, jiffies 4294824824 (age 22.546s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e67ed558>] kmalloc include/linux/slab.h:590 [inline]
[<00000000e67ed558>] kzalloc include/linux/slab.h:720 [inline]
[<00000000e67ed558>] netlbl_cipsov4_add_std net/netlabel/netlabel_cipso_v4.c:145 [inline]
[<00000000e67ed558>] netlbl_cipsov4_add+0x390/0x2340 net/netlabel/netlabel_cipso_v4.c:416
[<0000000006040154>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 net/netlink/genetlink.c:739
[<00000000204d7a1c>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
[<00000000204d7a1c>] genl_rcv_msg+0x2bf/0x4f0 net/netlink/genetlink.c:800
[<00000000c0d6a995>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504
[<00000000d78b9d2c>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
[<000000009733081b>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
[<000000009733081b>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340
[<00000000d5fd43b8>] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929
[<000000000a2d1e40>] sock_sendmsg_nosec net/socket.c:654 [inline]
[<000000000a2d1e40>] sock_sendmsg+0x139/0x170 net/socket.c:674
[<00000000321d1969>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350
[<00000000964e16bc>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404
[<000000001615e288>] __sys_sendmsg+0xd3/0x190 net/socket.c:2433
[<000000004ee8b6a5>] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47
[<00000000171c7cee>] entry_SYSCALL_64_after_hwframe+0x44/0xae

The memory of doi_def->map.std pointing is allocated in
netlbl_cipsov4_add_std, but no place has freed it. It should be
freed in cipso_v4_doi_free which frees the cipso DOI resource.

Affected products

VendorProductAffectedFixed
Linux Linux 2.6.19 4.4.274

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 5.10.46-1 —
Debian 13 linux 5.10.46-1 —
Debian 12 linux 5.10.46-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-raspi-realtime No fix yet —
Ubuntu 22.04 LTS linux-riscv +22 No fix yet —
Ubuntu 20.04 LTS linux 5.4.0-81.91 —
Ubuntu 20.04 LTS linux-aws 5.4.0-1055.58 —
Ubuntu 20.04 LTS linux-azure 5.4.0-1056.58 —
Ubuntu 20.04 LTS linux-bluefield 5.4.0-1019.22 —
Ubuntu 20.04 LTS linux-gcp 5.4.0-1051.55 —
Ubuntu 20.04 LTS linux-gke +26 No fix yet —
Ubuntu 20.04 LTS linux-gkeop 5.4.0-1022.23 —
Ubuntu 20.04 LTS linux-kvm 5.4.0-1045.47 —
Ubuntu 20.04 LTS linux-oracle 5.4.0-1053.57 —
Ubuntu 20.04 LTS linux-raspi 5.4.0-1042.46 —
Ubuntu 18.04 LTS linux 4.15.0-156.163 —
Ubuntu 18.04 LTS linux-aws 4.15.0-1111.118 —
Ubuntu 18.04 LTS linux-aws-5.4 5.4.0-1055.58~18.04.1 —
Ubuntu 18.04 LTS linux-azure-4.15 4.15.0-1123.136 —
Ubuntu 18.04 LTS linux-azure-5.4 5.4.0-1056.58~18.04.1 —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 18.04 LTS linux-gcp-4.15 4.15.0-1108.122 —
Ubuntu 18.04 LTS linux-gcp-5.4 5.4.0-1051.55~18.04.1 —
Ubuntu 18.04 LTS linux-hwe-5.4 5.4.0-81.91~18.04.1 —
Ubuntu 18.04 LTS linux-kvm 4.15.0-1099.101 —
Ubuntu 18.04 LTS linux-oracle 4.15.0-1080.88 —
Ubuntu 18.04 LTS linux-oracle-5.4 5.4.0-1053.57~18.04.1 —
Ubuntu 18.04 LTS linux-raspi-5.4 5.4.0-1042.46~18.04.3 —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro FIPS 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-updates 20.04 LTS linux-aws-fips 5.4.0-1069.73+fips2 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-azure-fips 5.4.0-1073.76+fips1 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-fips 5.4.0-1032.37 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-gcp-fips 5.4.0-1067.71~20.04.1 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-aws-fips 4.15.0-2053.55 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-azure-fips 4.15.0-2035.39 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-fips 4.15.0-1069.78 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-gcp-fips 4.15.0-2018.20 —
Ubuntu Pro FIPS-updates 16.04 LTS linux-fips No fix yet —
Ubuntu Pro 16.04 LTS linux +2 No fix yet —
Ubuntu Pro 16.04 LTS linux-aws-hwe 4.15.0-1111.118~16.04.1 —
Ubuntu Pro 16.04 LTS linux-azure 4.15.0-1123.136~16.04.1 —
Ubuntu Pro 16.04 LTS linux-gcp 4.15.0-1108.122~16.04.1 —
Ubuntu Pro 16.04 LTS linux-hwe 4.15.0-156.163~16.04.1 —
Ubuntu Pro 16.04 LTS linux-oracle 4.15.0-1080.88~16.04.1 —
Ubuntu Pro 14.04 LTS linux +2 No fix yet —
Ubuntu Pro 14.04 LTS linux-azure 4.15.0-1123.136~14.04.1 —
ReleasePackageFixed inAdvisory
SLES 12 SP5 kernel-azure +2 4.12.14-16.188.1 SUSE-SU-2024:1979-1
SLES 12 SP5 kernel-docs +4 4.12.14-122.219.1 SUSE-SU-2024:2184-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP5 kernel-azure +2 4.12.14-16.188.1 SUSE-SU-2024:1979-1
SLES for SAP 12 SP5 kernel-syms +2 4.12.14-122.219.1 SUSE-SU-2024:2184-1
SLE Real Time 12 SP5 kernel-rt +3 4.12.14-10.188.1 SUSE-SU-2024:1983-1
SLE Live Patching 12 SP5 kernel-default 4.12.14-122.219.1 SUSE-SU-2024:2184-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_57 1-8.3.1 SUSE-SU-2024:2184-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 kernel-livepatch-4.14.238-182.421 1.0-0.amzn2 ALAS2-2021-1685
Amazon Linux 2 perf +8 4.14.238-182.421.amzn2 ALAS2-2021-1685

Advisories 4

References