CVE-2021-47243 in Linux
Summary
by MITRE • 05/21/2024
In the Linux kernel, the following vulnerability has been resolved:
sch_cake: Fix out of bounds when parsing TCP options and header
The TCP option parser in cake qdisc (cake_get_tcpopt and cake_tcph_may_drop) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1.
This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack out of bounds when parsing TCP options.").
v2 changes:
Added doff validation in cake_get_tcphdr to avoid parsing garbage as TCP header. Although it wasn't strictly an out-of-bounds access (memory was allocated), garbage values could be read where CAKE expected the TCP header if doff was smaller than 5.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified as CVE-2021-47243 resides within the Linux kernel's sch_cake traffic control qdisc implementation, specifically in the TCP option parsing functionality. This flaw manifests in the cake_get_tcpopt and cake_tcph_may_drop functions where an out-of-bounds memory access occurs during TCP header processing. The vulnerability stems from insufficient bounds checking when handling TCP options with a length of one byte, creating a scenario where the parser attempts to read memory beyond the allocated buffer boundaries. The issue is particularly concerning because TCP options are critical components of network communication that must be parsed accurately to maintain proper connection handling and data integrity. When the TCP option length is set to one, the execution flow enters a loop that reads one byte for the opcode and then potentially reads an additional byte if the opcode is neither TCPOPT_EOL (end of option list) nor TCPOPT_NOP (no operation), resulting in memory access violations that could lead to system instability or potential exploitation.
The technical implementation of this vulnerability involves the parsing logic within the cake qdisc module which is responsible for quality of service management in network traffic. The flaw occurs because the parser does not properly validate the TCP option length before attempting to read subsequent bytes, leading to a classic buffer over-read condition. According to CWE-129, this represents an implementation weakness where insufficient validation of input data leads to memory access violations. The vulnerability is particularly dangerous because it operates at the kernel level where memory corruption can result in privilege escalation or system crashes. The fix implemented addresses this by adding proper bounds checking mechanisms that ensure the parser never attempts to read beyond the allocated TCP option buffer. This approach mirrors similar fixes found in the Linux kernel's ipv4 tcp_input module, demonstrating that this is a well-known class of vulnerability that affects various network processing components within the kernel.
The operational impact of CVE-2021-47243 extends beyond simple system instability to potentially compromise network security and system reliability. When exploited, this vulnerability could allow malicious actors to cause denial of service conditions by crafting specially formatted TCP packets that trigger the out-of-bounds read. The attack surface is broad as the cake qdisc is commonly used for traffic shaping and quality of service management in various network configurations. From an ATT&CK perspective, this vulnerability could be leveraged for privilege escalation or system compromise, as demonstrated by the potential for kernel memory corruption leading to unauthorized access. The vulnerability's exploitation requires network-level access to send malformed TCP packets to a target system, making it a network-based attack vector that aligns with techniques described in the ATT&CK framework for network infiltration. The presence of this vulnerability in the Linux kernel's core networking stack means that any system utilizing cake qdisc for traffic management is potentially at risk, particularly in environments where network security is paramount.
Mitigation strategies for CVE-2021-47243 primarily involve applying the kernel patches released by the Linux kernel development team, which implement the bounds checking fixes described in the vulnerability report. Organizations should prioritize updating their kernel versions to include the patched code that addresses both the TCP option parsing issue and the additional doff validation mentioned in the v2 changes. System administrators should also implement network monitoring to detect unusual TCP packet patterns that might indicate exploitation attempts, particularly focusing on malformed TCP options with length values of one. The fix addresses the root cause by ensuring that TCP header parsing validates the data offset field before proceeding with option parsing, preventing garbage values from being interpreted as valid TCP header data. This approach aligns with security best practices for kernel-level vulnerability remediation and follows the principle of least privilege by ensuring that all kernel network processing code maintains strict bounds checking. Additionally, network administrators should consider implementing firewall rules that can filter out suspicious TCP options to provide defense-in-depth protection against potential exploitation attempts. The vulnerability resolution demonstrates the importance of comprehensive input validation in kernel code and reinforces the need for regular security updates to maintain system integrity.