CVE-2021-47245

Q: What is the severity of CVE-2021-47245?

CVE-2021-47245 has a CVSS score of 7.1 (HIGH). This CVE describes an out-of-bounds read vulnerability in the Linux kernel's netfilter synproxy module when parsing TCP options. Attackers could potentially cause kernel crashes or information disclosure by sending specially crafted TCP packets. Systems running vulnerable Linux kernel versions with netfilter synproxy enabled are affected.

7.1 HIGH

📋 TL;DR

This CVE describes an out-of-bounds read vulnerability in the Linux kernel's netfilter synproxy module when parsing TCP options. Attackers could potentially cause kernel crashes or information disclosure by sending specially crafted TCP packets. Systems running vulnerable Linux kernel versions with netfilter synproxy enabled are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable kernel versions referenced in the git commits (need to check which kernel versions contain these commits)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when netfilter synproxy module is enabled and in use. Many distributions don't enable synproxy by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, or potential information disclosure from kernel memory

🟠

Likely Case

Kernel crash causing system instability or denial of service

🟢

If Mitigated

Minimal impact if synproxy is not enabled or systems are properly segmented

🌐 Internet-Facing: MEDIUM - Requires sending TCP packets to vulnerable systems, but synproxy is often used in firewall/gateway configurations

🏢 Internal Only: LOW - Requires network access to vulnerable systems, typically limited to internal network segments

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending specially crafted TCP packets to systems with synproxy enabled. No public exploit code identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits: 576c1526b4d83c44ad7b673cb841f36cbc6cb6c4, 5fc177ab759418c9537433e63301096e733fb915, 674b5f0c6a4fc5d3abce877048290cea6091fcb1, 6defc77d48eff74075b80ad5925061b2fc010d98, 7d9a9a1a88a3da574e019b4de756bc73337b3b0b

Vendor Advisory: https://git.kernel.org/stable/c/576c1526b4d83c44ad7b673cb841f36cbc6cb6c4

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable synproxy module

linux

Remove or disable the netfilter synproxy module if not required

modprobe -r nf_synproxy_core
echo 'blacklist nf_synproxy_core' >> /etc/modprobe.d/blacklist.conf

Network filtering

all

Use network firewalls to restrict TCP traffic to systems using synproxy

🧯 If You Can't Patch

Disable synproxy functionality in netfilter configuration
Implement network segmentation to isolate vulnerable systems

🔍 How to Verify

Check if Vulnerable:

Check if synproxy module is loaded: lsmod | grep synproxy. Check kernel version against affected ranges.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and synproxy module version matches patched kernel

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
System crash dumps
Netfilter error messages

Network Indicators:

Unusual TCP packets with malformed options sent to systems with synproxy

SIEM Query:

source="kernel" AND ("panic" OR "oops" OR "synproxy")

📊 Metadata

CVE ID: CVE-2021-47245

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

Published: May 21, 2024

Last Updated: December 30, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable synproxy module

Network filtering

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities