CVE-2021-42008

What it actually does

Slab out-of-bounds write in decode_data within the 6pack hamradio driver allowing memory corruption from CAP_NET_ADMIN input that escalates to root.

Why it matters to the business

Systems using affected Linux kernels can be fully compromised by attackers with limited network privileges, leading to loss of control over devices and potential lateral movement in networks.

How an attack unfolds

An attacker with CAP_NET_ADMIN crafts malicious input to the hamradio 6pack interface, triggering the out-of-bounds write in decode_data to corrupt kernel memory and obtain root access.

How to fix it

Update the Linux kernel to a version containing commit 19d1532a187669ce86d5a2696eb7275310070793 or later; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Verify the running kernel includes commit 19d1532a187669ce86d5a2696eb7275310070793 by checking git history or kernel version strings after recompilation; test that CAP_NET_ADMIN input no longer triggers out-of-bounds writes.

Typical attack path

1. Acquire CAP_NET_ADMIN capability on the target system
2. Configure or interact with a hamradio 6pack network interface
3. Send specially crafted data to invoke decode_data
4. Exploit the resulting slab out-of-bounds write for privilege escalation to root

How to detect it

Review kernel logs and audit records for 6pack driver activity combined with unexpected privilege changes or capability usage on network interfaces.

What your security team should do

• Prioritize kernel updates on all systems exposing hamradio or 6pack interfaces
• Restrict CAP_NET_ADMIN to only trusted processes and users
• Monitor for new kernel releases and apply fixes within standard patch windows