CVE-2021-47496: net/tls: Fix flipped sign in tls_err_abort() calls

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-22 · updated 2026-08-04
Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix flipped sign in tls_err_abort() calls sk->sk_err appears to expect a positive value, a convention that ktls doesn't always follow and that leads to memory corruption in other code. For instance, [kworker] tls_encrypt_done(..., err=<negative error from crypto request>) tls_err_abort(.., err) sk->sk_err = err; [task] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk->sk_err) { ret = -sk->sk_err; // ret is positive splice_from_pipe_feed (continued) ret = actor(...) // ret is still positive and interpreted as bytes // written, resulting in underflow of buf->len and // sd->len, leading to huge buf->offset and bogus // addresses computed in later calls to actor() Fix all tls_err_abort() callers to pass a negative error code consistently and centralize the error-prone sign flip there, throwing in a warning to catch future misuse and uninlining the function so it really does only warn once.

Affected products

Linux kernel: from 4.17 before 5.4.157; from 5.5 before 5.10.77; from 5.11 before 5.14.16; 5.15-rc1, 5.15-rc2, 5.15-rc3, 5.15-rc4, 5.15-rc5, 5.15-rc6 (+1) — fixed in 5.10.77, 5.14.16, 5.4.157

How to fix

Upgrade to a fixed version: Linux kernel 5.10.77, 5.14.16, 5.4.157. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47496 or the next vulnerability affects your stack