CVE-2021-39633

What it actually does

Invalid memory access in gre_handle_offloads of ip_gre.c triggers a page fault, allowing local disclosure of kernel memory contents without additional privileges.

Why it matters to the business

Local attackers could read sensitive kernel data such as credentials or encryption keys on affected devices, increasing risk of data exposure on systems using the vulnerable GRE implementation.

How an attack unfolds

A local attacker interacts with GRE interfaces or offload paths in the kernel networking stack to reach the flawed code path in ip_gre.c, inducing the invalid access and reading disclosed memory.

How to fix it

Upgrade whitesource/curekit (GIT) to the fixed commit af35e870ed09411d2f1fae6db1b04598cd1a31b6.

How to confirm the fix worked

Confirm the presence of commit af35e870ed09411d2f1fae6db1b04598cd1a31b6 in the ip_gre.c source or verify the product reports the patched version.

Typical attack path

1. Gain local access on the target system
2. Trigger GRE offload handling via network configuration or traffic
3. Cause page fault through invalid memory reference
4. Read leaked kernel memory contents

How to detect it

Examine kernel logs and crash reports for page faults originating from ip_gre.c; no widespread public exploitation artifacts are known.

What your security team should do

• Apply the fixed commit to all affected instances without delay
• Review local access controls and kernel networking configurations
• Monitor kernel logs for page fault patterns in GRE handling