Skip to content

kernel CVE-2021-28715

Moderate
cbgbt published GHSA-g455-4qrw-xr6m Jan 26, 2022

Package

kernel (bottlerocket)

Affected versions

< 1.5.3

Patched versions

1.5.3

Description

A flaw was found in the Linux kernel's netback driver which can cause the driver to use excessive amounts of memory. Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken to avoid piling up too much data, but those can be bypassed by the guest. There is a timeout on how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.

Severity

Moderate

CVE ID

CVE-2021-28715

Weaknesses

No CWEs