CVE-2021-47401 – This CVE describes an information leak vulnerab... (How to Fix)

Q: What is the severity of CVE-2021-47401?

CVE-2021-47401 has a CVSS score of 5.5 (MEDIUM). This CVE describes an information leak vulnerability in the Linux kernel's ipack ipoctal driver. The driver allocates tty device names on the stack, which can leak kernel stack memory to user space when accessed. This affects Linux systems using the vulnerable ipack driver module.

📋 TL;DR

This CVE describes an information leak vulnerability in the Linux kernel's ipack ipoctal driver. The driver allocates tty device names on the stack, which can leak kernel stack memory to user space when accessed. This affects Linux systems using the vulnerable ipack driver module.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if the ipack ipoctal driver is loaded and in use. This is not a default module for most systems.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure could reveal sensitive information including passwords, encryption keys, or other privileged data from kernel space, potentially leading to privilege escalation or system compromise.

🟠

Likely Case

Information disclosure of kernel stack memory, which could reveal system state information but requires local access and specific conditions to trigger.

🟢

If Mitigated

Minimal impact with proper access controls and SELinux/AppArmor policies restricting user access to tty devices.

🌐 Internet-Facing: LOW - Requires local access to the system and specific driver usage.

🏢 Internal Only: MEDIUM - Local users could potentially exploit this to gain information about kernel memory, but requires specific conditions and driver loading.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access, specific driver usage, and knowledge of how to trigger the information leak through tty device access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 0a9c36a2e06a, 2725925982dc, 5f6a309a6996, 741ea2670e02, 829f13d6079c

Vendor Advisory: https://git.kernel.org/stable/c/0a9c36a2e06a249acbed64e8e0b84637c2ad7575

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load patched kernel. 3. Verify ipack driver is not vulnerable by checking kernel version.

🔧 Temporary Workarounds

Unload ipack driver module

linux

Remove the vulnerable driver module if not needed

sudo rmmod ipoctal
sudo modprobe -r ipoctal

Blacklist ipack driver

linux

Prevent driver from loading at boot

echo 'blacklist ipoctal' | sudo tee /etc/modprobe.d/blacklist-ipoctal.conf

🧯 If You Can't Patch

Restrict access to tty devices using file permissions and mandatory access controls
Monitor for suspicious access to /dev/tty* devices and kernel module loading

🔍 How to Verify

Check if Vulnerable:

Check if ipack driver is loaded: lsmod | grep ipoctal. If loaded, check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and ipack driver is either not loaded or from patched kernel.

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages related to ipack or tty drivers
Unexpected access to /dev/tty* devices

Network Indicators:

None - local vulnerability only

SIEM Query:

process.name="cat" AND file.path="/dev/tty*" AND user.uid!=0

📊 Metadata

CVE ID: CVE-2021-47401

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-668

Published: May 21, 2024

Last Updated: September 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47401, you might also want to check these: