CVE-2021-47245 in Linux
Summary
by MITRE • 05/21/2024
In the Linux kernel, the following vulnerability has been resolved:
netfilter: synproxy: Fix out of bounds when parsing TCP options
The TCP option parser in synproxy (synproxy_parse_options) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1.
This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack out of bounds when parsing TCP options.").
v2 changes:
Added an early return when length < 0 to avoid calling skb_header_pointer with negative length.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified as CVE-2021-47245 resides within the Linux kernel's netfilter subsystem, specifically affecting the synproxy module responsible for handling TCP connection establishment. This flaw manifests as an out-of-bounds memory read condition that occurs during the parsing of TCP options within the synproxy_parse_options function. The issue represents a critical security concern as it could potentially allow malicious actors to exploit memory access violations that might lead to system instability or privilege escalation. The vulnerability directly impacts network security appliances, firewalls, and any system relying on netfilter's synproxy functionality for TCP connection handling and protection against SYN flood attacks.
The technical implementation of this vulnerability stems from improper bounds checking within the TCP option parsing logic. When processing TCP options with a length field set to 1, the parser enters a loop that reads one byte for the opcode and subsequently reads an additional byte if the opcode is neither TCPOPT_EOL (end of option list) nor TCPOPT_NOP (no operation). This behavior creates a situation where memory beyond the allocated buffer boundaries is accessed, violating fundamental memory safety principles. The flaw is particularly insidious because it occurs during normal network processing operations, making it difficult to detect and exploit through conventional means while still maintaining the potential for serious system compromise.
The operational impact of this vulnerability extends across various network security implementations that depend on the Linux kernel's netfilter framework. Systems utilizing synproxy for connection tracking, load balancing, or DDoS protection are particularly at risk, as attackers could potentially trigger the out-of-bounds read through carefully crafted TCP packets. The vulnerability's exploitation could result in system crashes, denial of service conditions, or in more sophisticated attack scenarios, could provide a foothold for further exploitation. This issue particularly affects enterprise network infrastructure, cloud computing environments, and security appliances that process large volumes of TCP traffic and rely on kernel-level TCP option parsing for their operations.
The fix for CVE-2021-47245 addresses the core issue by implementing proper bounds validation before memory access operations. The solution incorporates an early return mechanism when the length parameter is negative, preventing the skb_header_pointer function from being called with invalid parameters. This approach aligns with established security practices for buffer overflow prevention and follows the same methodology used in a previous fix referenced in commit 9609dad263f8, which addressed similar issues in the ipv4 tcp_input module. The mitigation strategy emphasizes defensive programming techniques that prevent out-of-bounds memory access through proactive input validation and proper error handling, ensuring that all memory operations within the TCP option parsing process remain within defined boundaries. This fix demonstrates the importance of maintaining robust input validation in kernel space code, where memory safety violations can have severe consequences for system integrity and security. The vulnerability maps to CWE-129 and CWE-787 categories, representing issues related to insufficient input validation and out-of-bounds read conditions respectively, while also aligning with ATT&CK techniques involving privilege escalation and system exploitation through kernel vulnerabilities.