CVE-2021-47243 – A buffer read vulnerability in the Linux kernel... (How to Fix)

Q: What is the severity of CVE-2021-47243?

CVE-2021-47243 has a CVSS score of 7.1 (HIGH). A buffer read vulnerability in the Linux kernel's CAKE (Common Applications Kept Enhanced) queuing discipline allows reading one byte out of bounds when parsing TCP options. This could lead to kernel memory disclosure or crashes. Systems using Linux kernels with CAKE qdisc enabled are affected.

📋 TL;DR

A buffer read vulnerability in the Linux kernel's CAKE (Common Applications Kept Enhanced) queuing discipline allows reading one byte out of bounds when parsing TCP options. This could lead to kernel memory disclosure or crashes. Systems using Linux kernels with CAKE qdisc enabled are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when CAKE qdisc is configured and active on network interfaces

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, or potential information disclosure from kernel memory

🟠

Likely Case

System crash or instability when processing malformed TCP packets with CAKE enabled

🟢

If Mitigated

Minimal impact if CAKE is not used or proper packet filtering is in place

🌐 Internet-Facing: MEDIUM - Requires malformed TCP packets to reach vulnerable system, but CAKE is not commonly enabled by default

🏢 Internal Only: LOW - Requires specific CAKE configuration and malformed internal traffic

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending specially crafted TCP packets to a system with CAKE enabled

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 3371392c60e2, 3b491dd593d5, 4cefa061fc63, 595897ef118d, or ba91c49dedbd

Vendor Advisory: https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable CAKE qdisc

linux

Remove CAKE configuration from network interfaces

tc qdisc del dev <interface> root cake
Check with: tc qdisc show

🧯 If You Can't Patch

Disable CAKE qdisc on all network interfaces
Implement network filtering to block malformed TCP packets at perimeter

🔍 How to Verify

Check if Vulnerable:

Check if CAKE is configured: tc qdisc show | grep cake

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched versions from your distribution

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
System crash dumps
Network interface errors

Network Indicators:

Malformed TCP packets with unusual option lengths

SIEM Query:

Search for kernel panic events or network interface errors on systems with CAKE configured

📊 Metadata

CVE ID: CVE-2021-47243

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

Published: May 21, 2024

Last Updated: December 30, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47243, you might also want to check these: