CVE-2021-47244 in Linux
Summary
by MITRE • 05/21/2024
In the Linux kernel, the following vulnerability has been resolved:
mptcp: Fix out of bounds when parsing TCP options
The TCP option parser in mptcp (mptcp_get_options) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1.
This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack out of bounds when parsing TCP options.").
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability CVE-2021-47244 represents a critical out-of-bounds memory access flaw within the Linux kernel's Multipath TCP implementation. This issue specifically affects the mptcp_get_options function which is responsible for parsing TCP options in the Multipath TCP protocol. The flaw occurs during the processing of TCP option headers where the parser fails to properly validate buffer boundaries, leading to potential memory corruption and system instability. The vulnerability is particularly concerning because it exists in the kernel's core networking stack where it can be triggered by malformed TCP packets, making it exploitable in network-based attacks.
The technical root cause of this vulnerability lies in improper bounds checking within the TCP option parsing logic. When the parser encounters a TCP option with a length field set to 1, it enters a processing loop that reads one byte for the opcode and then conditionally reads a second byte if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP. However, this second read occurs without verifying that sufficient data remains in the buffer, resulting in an out-of-bounds memory access. This type of vulnerability falls under CWE-129, which specifically addresses insufficient bounds checking, and more broadly under CWE-787, which covers out-of-bounds write operations. The flaw demonstrates a classic buffer over-read condition that can lead to information disclosure or system crashes.
The operational impact of CVE-2021-47244 extends beyond simple denial of service scenarios, as it represents a potential vector for more sophisticated attacks. Systems running Linux kernels with Multipath TCP enabled are particularly vulnerable, including servers, routers, and network infrastructure devices that process TCP traffic. Attackers could potentially exploit this vulnerability by sending specially crafted TCP packets with malformed option headers, causing the kernel to read beyond allocated memory boundaries. This could result in system crashes, memory corruption, or in some cases, privilege escalation. The vulnerability's exploitation risk is heightened because it requires no special privileges and can be triggered through normal network traffic processing. According to ATT&CK framework, this vulnerability maps to T1071.004 for application layer protocol and T1499.004 for network Denial of Service, as it can be leveraged to disrupt network services.
Mitigation strategies for CVE-2021-47244 should focus on immediate kernel updates and network monitoring. Organizations should prioritize applying the patched kernel version that contains the fix implemented in commit 9609dad263f8, which introduced proper bounds checking for TCP option parsing. System administrators should also implement network segmentation and monitoring to detect anomalous TCP packet patterns that might indicate exploitation attempts. Additional defensive measures include configuring firewalls to filter malformed TCP packets and implementing intrusion detection systems that can identify potential exploitation attempts. The fix itself demonstrates the importance of robust input validation in kernel space code, where even seemingly minor boundary checks can prevent significant security vulnerabilities. Organizations should also consider disabling Multipath TCP functionality on systems where it is not required, reducing the attack surface for this particular vulnerability while maintaining overall system security posture.