CVE-2021-45485

What it actually does

The flaw in net/ipv6/output_core.c causes an information leak because a hash table sized for IPv6 does not account for attackers freely selecting among many source addresses, allowing observation of hash collisions or table behavior that reveals kernel memory contents.

Why it matters to the business

Organizations running Linux systems face increased risk of sensitive data exposure that can aid further attacks, raising operational and compliance costs especially on widely deployed kernels with many downstream dependents.

How an attack unfolds

An attacker sends sequences of IPv6 packets using chosen source addresses to the target, observes responses or side effects that expose hash table state, and extracts leaked kernel information without authentication.

How to fix it

Upgrade the Linux kernel to the fixed commit 62f20e068ccc50d6ab66fdb72ba90da2b9418c99 or any later version containing the patch; rebuild and deploy updated kernels across all affected systems.

How to confirm the fix worked

Verify the running kernel source contains commit 62f20e068ccc50d6ab66fdb72ba90da2b9418c99, confirm the vulnerable hash table logic in output_core.c has been replaced, and test that multiple IPv6 source address probes no longer produce observable leaks.

Typical attack path

1. Scan for systems running vulnerable Linux kernel versions before 5.13.3
2. Generate and transmit IPv6 packets with varying attacker-controlled source addresses
3. Monitor kernel responses or observable behavior for hash table artifacts
4. Extract and analyze leaked information to map kernel memory or enable follow-on exploits

How to detect it

Inspect network flow logs and packet captures for high volumes of IPv6 packets from single sources using many distinct addresses; correlate with kernel audit logs or dmesg entries showing unusual hash table activity on systems that remain unpatched.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and internal Linux hosts given the 1761 days since publication and steady EPSS trend
• Implement network segmentation and IPv6 filtering to reduce exposure while patches are applied
• Review system and network logs for anomalous IPv6 traffic patterns as part of routine hunting