{
  "affected": [
    {
      "database_specific": {
        "unresolved_ranges": [
          {
            "events": [
              {
                "introduced": "4.19"
              },
              {
                "fixed": "4.19.196"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "4.20"
              },
              {
                "fixed": "5.4.128"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "5.5"
              },
              {
                "fixed": "5.10.46"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "5.11"
              },
              {
                "fixed": "5.12.13"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "5.13-rc1"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "5.13-rc2"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "5.13-rc3"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "5.13-rc4"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "5.13-rc5"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "5.13-rc6"
              }
            ]
          }
        ]
      }
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_cake: Fix out of bounds when parsing TCP options and header\n\nThe TCP option parser in cake qdisc (cake_get_tcpopt and\ncake_tcph_may_drop) could read one byte out of bounds. When the length\nis 1, the execution flow gets into the loop, reads one byte of the\nopcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads\none more byte, which exceeds the length of 1.\n\nThis fix is inspired by commit 9609dad263f8 (\"ipv4: tcp_input: fix stack\nout of bounds when parsing TCP options.\").\n\nv2 changes:\n\nAdded doff validation in cake_get_tcphdr to avoid parsing garbage as TCP\nheader. Although it wasn't strictly an out-of-bounds access (memory was\nallocated), garbage values could be read where CAKE expected the TCP\nheader if doff was smaller than 5.",
  "id": "CVE-2021-47243",
  "modified": "2026-03-15T21:45:34.391153607Z",
  "published": "2024-05-21T15:15:13.403Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3b491dd593d582ceeb27aa617600712a6bd14246"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4cefa061fc63f4d2dff5ab4083f43857cd7a2335"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/595897ef118d6fe66690c4fc5b572028c9da95b7"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ba91c49dedbde758ba0b72f57ac90b06ddf8e548"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}