CVE-2021-47010

What it actually does

A non-init network namespace can invoke tcp_set_default_congestion_control with a restricted congestion-control algorithm, which sets the global ca->flags TCP_CONG_NON_RESTRICTED bit and thereby mutates the read-only net.ipv4.tcp_allowed_congestion_control sysctl outside its intended namespace boundary.

Why it matters to the business

Attackers who can create containers or other isolated network namespaces may alter host-wide TCP congestion-control policy, potentially degrading network performance, bypassing intended restrictions, or interfering with system-wide traffic-management controls.

How an attack unfolds

An attacker with local access creates or enters a non-init netns (for example inside a container), then calls the setsockopt or sysctl interface that reaches tcp_set_default_congestion_control with a restricted algorithm name; the kernel incorrectly updates the global sysctl, completing the privilege-escalation path without requiring additional credentials.

How to fix it

Apply the upstream fix that gates the restricted-algorithm path to the init_net namespace only; rebuild and deploy kernels containing commit 97684f0970f6 and the subsequent correction described in CVE-2021-47010; where distribution packages are available, install the corrected kernel and reboot.

How to confirm the fix worked

After patching, confirm that attempts to set a restricted congestion-control algorithm from a non-init netns are rejected while the same operation succeeds from the init_net; verify that net.ipv4.tcp_allowed_congestion_control remains unchanged when modified from any non-init namespace.

Typical attack path

1. Obtain local execution inside a container or other non-init network namespace
2. Invoke tcp_set_default_congestion_control (via setsockopt TCP_CONGESTION or equivalent) supplying a restricted congestion-control module name
3. Observe mutation of the host-global tcp_allowed_congestion_control sysctl
4. Leverage the altered global policy for follow-on network or denial-of-service activity

How to detect it

Review kernel audit logs and syslog for calls to setsockopt with TCP_CONGESTION targeting restricted algorithms originating from non-init netns; inspect /proc/sys/net/ipv4/tcp_allowed_congestion_control for unexpected modifications correlated with container or namespace activity.

What your security team should do

• Prioritize patching kernel packages on all systems that support user-created network namespaces or containers
• Audit container runtime configurations to ensure untrusted workloads cannot create additional network namespaces if immediate patching is delayed
• Monitor for unexpected changes to tcp_allowed_congestion_control via system-audit or kernel-logging mechanisms