CVE-2021-4439

What it actually does

The vulnerability permits an out-of-bounds array access (negative index) in detach_capi_ctr when a cmtp session is created against an unregistered controller, resulting in memory corruption or kernel panic during kthread execution.

Why it matters to the business

Systems may experience unexpected crashes or instability when processing specific ISDN/CAPI network sessions, leading to denial of service and potential operational disruption on affected Linux kernels.

How an attack unfolds

An attacker triggers creation of a cmtp session via cmtp_add_connection, causing the kernel thread to invoke detach_capi_ctr on an unattached controller and read an invalid array index, which can be reached through local or network-adjacent ISDN interfaces.

How to fix it

Apply the upstream kernel patch that adds a bounds check on ctr->cnr before accessing the capi_ctr array; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Confirm presence of the ctr->cnr bounds check in drivers/isdn/capi/kcapi.c; attempt to reproduce the cmtp session creation and verify absence of UBSAN out-of-bounds reports.

Typical attack path

1. Establish or emulate an ISDN CAPI controller context
2. Invoke cmtp_add_connection to register a session and spawn kcmtpd_ctr kthread
3. Force detach_capi_ctr path before controller attachment completes
4. Trigger array access with index -1 leading to UBSAN fault or corruption

How to detect it

Review kernel logs for UBSAN array-index-out-of-bounds messages referencing kcapi.c and detach_capi_ctr; inspect for unexpected kcmtpd_ctr_* kthreads and associated crashes.

• UBSAN: array-index-out-of-bounds in drivers/isdn/capi/kcapi.c
• index -1 is out of range for type 'capi_ctr *[32]'
• detach_capi_ctr+0x64/0xc0
• cmtp_session+0x5c8/0x5d0
• kcmtpd_ctr_

What your security team should do

• Prioritize kernel updates on systems exposing ISDN/CAPI interfaces
• Monitor for kernel oops or UBSAN reports involving detach_capi_ctr
• Disable unused ISDN modules where possible to reduce attack surface