CVE-2021-47546
📋 TL;DR
A memory leak vulnerability in the Linux kernel's IPv6 routing subsystem allows attackers to cause denial of service through resource exhaustion. Systems with specific IPv6 nftables firewall rules and routing suppression rules are affected. This impacts Linux systems with IPv6 enabled and specific firewall configurations.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Complete system crash due to memory exhaustion, leading to denial of service and potential system instability.
Likely Case
Gradual performance degradation and eventual system instability as memory is consumed over time.
If Mitigated
Minimal impact if systems have memory limits or monitoring that detects abnormal consumption.
🎯 Exploit Status
Reproduction steps are publicly documented. Exploitation requires sending IPv6 packets to trigger the leak.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commits 209d35ee34e25f9668c404350a1c86d914c54ffa or later
Vendor Advisory: https://git.kernel.org/stable/c/209d35ee34e25f9668c404350a1c86d914c54ffa
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.
🔧 Temporary Workarounds
Remove vulnerable nftables rule
linuxRemove the specific nftables rule that triggers the memory leak
sudo nft delete rule inet test test_chain handle <handle>
sudo nft delete chain inet test test_chain
sudo nft delete table inet test
Remove IPv6 routing suppression rule
linuxRemove the IPv6 routing rule with suppress_prefixlength
sudo ip -6 rule del table main suppress_prefixlength 0
Disable IPv6
linuxCompletely disable IPv6 if not needed
echo 'net.ipv6.conf.all.disable_ipv6 = 1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
🧯 If You Can't Patch
- Remove the specific nftables fib rule for IPv6 that triggers the vulnerability
- Monitor ip6_dst_cache slab usage and restart system if memory consumption becomes excessive
🔍 How to Verify
Check if Vulnerable:
Check if both conditions exist: 1) nft list ruleset shows fib rule for IPv6, 2) ip -6 rule show shows suppress_prefixlength ruleCheck Version:
uname -rVerify Fix Applied:
Monitor slabtop -o | grep ip6_dst_cache while sending IPv6 packets - memory should not increase abnormally📡 Detection & Monitoring
Log Indicators:
- Kernel oom-killer messages
- System logs showing memory exhaustion
Network Indicators:
- Abnormal IPv6 traffic patterns to trigger the leak
SIEM Query:
source="kernel" AND ("oom-killer" OR "Out of memory" OR "slab allocation failure")🔗 References
- https://git.kernel.org/stable/c/209d35ee34e25f9668c404350a1c86d914c54ffa
- https://git.kernel.org/stable/c/8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383
- https://git.kernel.org/stable/c/cdef485217d30382f3bf6448c54b4401648fe3f1
- https://git.kernel.org/stable/c/ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29
- https://git.kernel.org/stable/c/209d35ee34e25f9668c404350a1c86d914c54ffa
- https://git.kernel.org/stable/c/8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383
- https://git.kernel.org/stable/c/cdef485217d30382f3bf6448c54b4401648fe3f1
- https://git.kernel.org/stable/c/ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29
