CVE-2021-47274 – This is a memory corruption vulnerability in th... (How to Fix)

Q: What is the severity of CVE-2021-47274?

CVE-2021-47274 has a CVSS score of 9.8 (CRITICAL). This is a memory corruption vulnerability in the Linux kernel's tracing subsystem caused by an incorrect length check in the ftrace buffer. It allows out-of-bounds memory writes that can lead to kernel crashes or potential privilege escalation. All systems running affected Linux kernel versions are vulnerable.

📋 TL;DR

This is a memory corruption vulnerability in the Linux kernel's tracing subsystem caused by an incorrect length check in the ftrace buffer. It allows out-of-bounds memory writes that can lead to kernel crashes or potential privilege escalation. All systems running affected Linux kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux Kernel

Versions: Multiple versions including 4.19 LTS and others (specific commits indicate various affected versions)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires kernel tracing functionality (ftrace) to be accessible. Some distributions may restrict access to tracing features by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to root via kernel memory corruption.

🟠

Likely Case

Kernel crashes and system instability, particularly when tracing functionality is used.

🟢

If Mitigated

Limited impact if tracing features are disabled or not in use, though the vulnerable code path still exists.

🌐 Internet-Facing: MEDIUM - Requires local access or ability to trigger kernel tracing functions, but could be combined with other vulnerabilities.

🏢 Internal Only: HIGH - Local users or processes can trigger the vulnerability, potentially leading to privilege escalation or denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to trigger kernel tracing functions, typically requiring some level of access. The vulnerability was discovered in production environments causing crashes.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple kernel versions with fixes (see commit references)

Vendor Advisory: https://git.kernel.org/stable/c/2d598902799886d67947406f26ee8e5fd2ca097f

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable ftrace/kprobes

linux

Disable kernel tracing functionality to prevent exploitation

echo 0 > /sys/kernel/debug/tracing/tracing_on
echo 0 > /proc/sys/kernel/kptr_restrict

Restrict tracing capabilities

linux

Use kernel capabilities or SELinux/AppArmor to restrict access to tracing functions

setcap -r /bin/dmesg
chmod 600 /sys/kernel/debug/tracing/*

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized users from using tracing functions
Monitor system logs for kernel crashes or out-of-bounds memory access warnings

🔍 How to Verify

Check if Vulnerable:

Check kernel version against affected versions. Vulnerable if using unpatched kernel with tracing enabled.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version matches patched version from vendor and check that /sys/kernel/debug/tracing functions work without crashes.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
'general protection fault' errors
'Out-of-bounds write' kernel messages
Page fault errors in kernel logs

Network Indicators:

None - this is a local kernel vulnerability

SIEM Query:

source="kernel" AND ("general protection fault" OR "Out-of-bounds" OR "page_fault" OR "BUG:")

📊 Metadata

CVE ID: CVE-2021-47274

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-125

Published: May 21, 2024

Last Updated: April 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47274, you might also want to check these: