CVE-2021-47606 – A division-by-zero vulnerability in the Linux k... (How to Fix)

Q: What is the severity of CVE-2021-47606?

CVE-2021-47606 has a CVSS score of 5.5 (MEDIUM). A division-by-zero vulnerability in the Linux kernel's netlink subsystem allows attackers to cause kernel crashes (denial of service) when processing specially crafted network packets. This affects Linux systems using the netem network emulation module. The vulnerability is triggered when empty network packets are processed, leading to a kernel panic.

📋 TL;DR

A division-by-zero vulnerability in the Linux kernel's netlink subsystem allows attackers to cause kernel crashes (denial of service) when processing specially crafted network packets. This affects Linux systems using the netem network emulation module. The vulnerability is triggered when empty network packets are processed, leading to a kernel panic.

💻 Affected Systems

Products:

Linux Kernel

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when netem (Network Emulator) module is loaded and configured. Not all systems use this module by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially disrupting critical network services.

🟠

Likely Case

Local or remote denial of service through kernel crash, requiring system reboot to recover.

🟢

If Mitigated

Minimal impact if netem module is not loaded or if systems are patched.

🌐 Internet-Facing: MEDIUM - Requires network access and specific conditions, but could be exploited remotely if netem is configured.

🏢 Internal Only: MEDIUM - Internal attackers could exploit if they have network access to vulnerable systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Crash reproduction code is available in the CVE description. Exploitation requires ability to send crafted network packets to systems with netem enabled.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 40cf2e058832d9cfaae98dfd77334926275598b6, 4c986072a8c9249b9398c7a18f216dc26a9f0e35, 54e785f7d5c197bc06dbb8053700df7e2a093ced, c0315e93552e0d840e9edc6abd71c7db82ec8f51, c54a60c8fbaa774f828e26df79f66229a8a0e010

Vendor Advisory: https://git.kernel.org/stable/c/40cf2e058832d9cfaae98dfd77334926275598b6

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable netem module

linux

Unload the netem kernel module if not required

sudo rmmod sch_netem
echo 'blacklist sch_netem' | sudo tee /etc/modprobe.d/blacklist-netem.conf

Prevent module autoload

linux

Prevent netem from being automatically loaded

echo 'install sch_netem /bin/false' | sudo tee /etc/modprobe.d/disable-netem.conf

🧯 If You Can't Patch

Ensure netem module is not loaded on critical systems
Implement network segmentation to limit access to systems using netem

🔍 How to Verify

Check if Vulnerable:

Check if netem module is loaded: lsmod | grep netem. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or is newer than vulnerable versions. Confirm netem module functions without crashes.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages mentioning 'divide error'
Netem-related crash reports in dmesg or system logs
System reboots following network traffic

Network Indicators:

Unusual network packets targeting systems with netem enabled
Traffic patterns attempting to trigger empty packet conditions

SIEM Query:

source="kernel" AND ("divide error" OR "netem" OR "sch_netem")

📊 Metadata

CVE ID: CVE-2021-47606

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-369

Published: June 19, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47606, you might also want to check these: