CVE-2021-46955: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-46955 is a stack out-of-bounds read vulnerability discovered in the Linux kernel's openvswitch module when fragmenting IPv4 packets. The vulnerability was disclosed on February 27, 2024, and affects Linux kernel versions from 4.4.134 through 5.12.3 (NVD).

The vulnerability occurs in the ovs_fragment() function when handling IPv4 packets. When using a temporary struct dst_entry, the pointer is incorrectly used as a pointer to struct rtable in the call chain: ip_do_fragment() -> ip_skb_dst_mtu() -> ip_dst_mtu_maybe_forward() -> ip_mtu_locked(). This results in an out-of-bounds read access to struct members like rt_mtu_locked in the stack. The issue was discovered using KASAN (Kernel Address Sanitizer) during IPv4 packet fragmentation testing (Kernel Patch).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. This indicates that while local access is required, the vulnerability can lead to high impacts on confidentiality and availability of the system (NVD).

The vulnerability requires local access to the system and can be triggered when running openvswitch on kernels built with KASAN. The issue manifests during the fragmentation of IPv4 packets, potentially allowing an attacker to cause a denial of service or read sensitive information from kernel memory (Kernel Patch).

The vulnerability has been fixed by changing the temporary variable used for IPv4 packets in ovs_fragment() to use struct rtable instead of struct dst_entry, similar to the implementation for IPv6. The fix has been incorporated into various kernel versions through patches (Kernel Patch).