In the Linux kernel, the following vulnerability has been resolved:

net: Only allow init netns to set default tcp cong to a restricted algo

tcp_set_default_congestion_control() is netns-safe in that it writes
to &net->ipv4.tcp_congestion_control, but it also sets
ca->flags |= TCP_CONG_NON_RESTRICTED which is not namespaced.
This has the unintended side-effect of changing the global
net.ipv4.tcp_allowed_congestion_control sysctl, despite the fact that it
is read-only: 97684f0970f6 ("net: Make tcp_allowed_congestion_control
readonly in non-init netns")

Resolve this netns "leak" by only allowing the init netns to set the
default algorithm to one that is restricted. This restriction could be
removed if tcp_allowed_congestion_control were namespace-ified in the
future.

This bug was uncovered with
https://github.com/JonathonReinhart/linux-netns-sysctl-verify

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0002.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
6670e152447732ba90626f36dfc015a13fbf150e affected < 992de06308d9a9584d59b96d294ac676f924e437
6670e152447732ba90626f36dfc015a13fbf150e affected < 9884f745108f7d25b189bbcd6754e284fb29ab68
6670e152447732ba90626f36dfc015a13fbf150e affected < 6c1ea8bee75df8fe2184a50fcd0f70bf82986f42
6670e152447732ba90626f36dfc015a13fbf150e affected < efe1532a6e1a8e3c343d04fff510f0ed80328f9c
6670e152447732ba90626f36dfc015a13fbf150e affected < e7d7bedd507bb732e600403b7a96f9fe48d0ca31
6670e152447732ba90626f36dfc015a13fbf150e affected < 8d432592f30fcc34ef5a10aac4887b4897884493
Linux Linux affected
Version Status Constraints
4.15 affected —
0 unaffected < 4.15
4.19.191 unaffected ≤ 4.19.*
5.4.119 unaffected ≤ 5.4.*
5.10.37 unaffected ≤ 5.10.*
5.11.21 unaffected ≤ 5.11.*
5.12.4 unaffected ≤ 5.12.*
5.13 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/6c1ea8bee75df8fe2184a50fcd0f70bf82986f42 cve-icon cve-icon
https://git.kernel.org/stable/c/8d432592f30fcc34ef5a10aac4887b4897884493 cve-icon cve-icon
https://git.kernel.org/stable/c/9884f745108f7d25b189bbcd6754e284fb29ab68 cve-icon cve-icon
https://git.kernel.org/stable/c/992de06308d9a9584d59b96d294ac676f924e437 cve-icon cve-icon
https://git.kernel.org/stable/c/e7d7bedd507bb732e600403b7a96f9fe48d0ca31 cve-icon cve-icon
https://git.kernel.org/stable/c/efe1532a6e1a8e3c343d04fff510f0ed80328f9c cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024022830-CVE-2021-47010-6853@gregkh/T/#u cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47010 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47010 cve-icon
History

Wed, 19 Mar 2025 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Mon, 04 Nov 2024 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Aug 2024 17:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T07:02:15.538Z

Reserved: 2024-02-27T18:42:55.953Z

Link: CVE-2021-47010

cve-icon Vulnrichment

Updated: 2024-08-04T05:24:39.534Z

cve-icon NVD

Status : Analyzed

Published: 2024-02-28T09:15:38.657

Modified: 2025-03-19T15:30:02.273

Link: CVE-2021-47010

cve-icon Redhat

Severity : Low

Publid Date: 2024-02-28T00:00:00Z

Links: CVE-2021-47010 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses