CVE-2021-47591
📋 TL;DR
A null pointer dereference vulnerability in the Linux kernel's MPTCP implementation allows local attackers to crash the kernel when TCP_ULP setsockopt is called on MPTCP sockets in fallback mode. This affects Linux systems with MPTCP enabled and can lead to denial of service. The vulnerability requires local access to trigger.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, potentially disrupting critical services.
Likely Case
Local denial of service through kernel crash, requiring system reboot to restore functionality.
If Mitigated
Minimal impact if MPTCP is disabled or systems are patched, as exploitation requires local access.
🎯 Exploit Status
Syzbot found and triggered the crash. Exploitation requires local access and ability to call setsockopt with TCP_ULP on MPTCP sockets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.16-rc2 and later
Vendor Advisory: https://git.kernel.org/stable/c/3de0c86d42f841d1d64f316cd949e65c566f0734
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.16-rc2 or later. 2. For stable branches, apply commit 3de0c86d42f841d1d64f316cd949e65c566f0734. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable MPTCP
linuxDisable MPTCP support in kernel configuration to prevent exploitation
echo 'net.mptcp.enabled=0' >> /etc/sysctl.conf
sysctl -p
Restrict setsockopt permissions
linuxUse SELinux/AppArmor to restrict setsockopt syscall for untrusted processes
🧯 If You Can't Patch
- Disable MPTCP via sysctl or kernel boot parameters
- Implement strict access controls to prevent untrusted users from creating MPTCP sockets
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If version is before 5.16-rc2 and MPTCP is enabled, system may be vulnerable.Check Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.16-rc2 or later: uname -r. Check that commit 3de0c86d42f841d1d64f316cd949e65c566f0734 is present in kernel source.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- KASAN null-ptr-deref reports in dmesg
- System crash/reboot events
Network Indicators:
- MPTCP connection attempts followed by system instability
SIEM Query:
event_type:kernel_panic OR event_type:system_crash AND process_name:syz-executor