Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw affects virtual Ethernet networking, commonly used by containers. Under specific veth offload conditions, malformed packet handling can trigger a kernel BUG and potentially serious confidentiality and availability impact. It is not listed in KEV, and the provided sources do not show active exploitation.
Executive priority
Treat as a moderate patching priority for Linux container infrastructure. It requires local high privileges, but a kernel-level crash or impact on shared hosts can create operational risk. Fold remediation into kernel maintenance unless exposed container hosts are especially sensitive.
Technical view
The veth driver could pass shared or cloned TCP skbs into GRO after NAPI enablement without XDP. With GRO enabled on veth and peer TSO disabled, later TCP processing could hit a kernel BUG in skb_shift. Stable fixes skip GRO for shared or cloned skbs, attempting unclone first.
Likely exposure
Most relevant to Linux systems using vulnerable 5.13 through 5.16-era kernels with veth-based networking, including container hosts. Exposure depends on specific GRO, TSO, NAPI, and XDP conditions described in the kernel report. Systems on vendor kernels may already have backported fixes.
Exploitation context
The CVSS vector is local, low complexity, high privileges, and no user interaction. The source bundle shows a kernel crash report and fix rationale, but does not provide public exploitation evidence. KEV is false, so active exploitation should not be assumed.
Researcher notes
The evidence is strongest for a veth/GRO skb lifetime handling bug fixed upstream. The provided CVSS includes high confidentiality and availability impact, but the bundle mainly documents a BUG trace and corrective logic. Avoid assuming broader exploitability without vendor or kernel maintainer detail.
Mitigation direction
- Upgrade affected Linux kernels to versions containing the referenced stable fixes.
- Check distribution advisories for backported kernel packages covering this issue.
- Prioritize container hosts or workloads relying heavily on veth networking.
- Follow vendor guidance for temporary mitigations; none are named in the provided sources.
Validation and detection
- Inventory running Linux kernel versions against the affected 5.13 to 5.16-era range.
- Confirm vendor kernel packages include the referenced stable commits or equivalent backports.
- Identify hosts using veth networking with GRO enabled and peer TSO disabled.
- Review kernel logs for matching BUG traces in skbuff.c or skb_shift.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47099 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H0.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d2269ae48598e05b59ec9ea9e6e44fd33941130dCVE reference, Linux
- https://git.kernel.org/stable/c/9695b7de5b4760ed22132aca919570c0190cb0ceCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.