CVE-2021-43389

What it actually does

Array-index-out-of-bounds read/write in detach_capi_ctr within drivers/isdn/capi/kcapi.c allows local memory corruption or kernel panic when an invalid controller index is processed during CAPI device detachment.

Why it matters to the business

Local denial-of-service or system instability on Linux kernels using ISDN/CAPI subsystems; older unpatched kernels remain exposed years after disclosure, increasing operational risk for embedded or legacy deployments.

How an attack unfolds

An attacker with local access crafts CAPI controller operations that supply an out-of-range index to detach_capi_ctr, triggering the bounds violation and resulting in a crash or potential escalation on vulnerable kernels; public exploit code exists and general Linux kernel privilege-escalation techniques have been observed in related campaigns.

How to fix it

Upgrade the Linux kernel to commit 1f3e2e97c003f80c4b087092b225c8787ff91e4d or later; apply the corresponding stable backports for the running distribution kernel and reboot affected systems.

How to confirm the fix worked

Verify kernel version is at or above the fixed commit; inspect kcapi.c for the corrected index validation in detach_capi_ctr; run regression tests exercising CAPI attach/detach paths.

Typical attack path

1. Obtain local shell or user context on target Linux system
2. Load or trigger ISDN/CAPI subsystem if not already active
3. Invoke detach_capi_ctr via crafted capi controller detachment sequence
4. Trigger array out-of-bounds access leading to kernel panic or memory corruption
5. Leverage resulting instability or corruption for denial-of-service or further exploitation

How to detect it

Review kernel logs for oops or panic messages referencing kcapi.c or detach_capi_ctr; search audit logs for unusual CAPI device operations by non-privileged users; examine exploit artifacts associated with Linux kernel privilege-escalation techniques.

What your security team should do

• Prioritize kernel upgrades on all systems exposing ISDN/CAPI interfaces
• Restrict local user access to CAPI device nodes via permissions or SELinux/AppArmor policies
• Monitor for kernel oops/panic logs related to kcapi.c
• Disable unused ISDN/CAPI modules in kernel configuration where feasible