CVE-2021-47082

What it actually does

Double-free of dev->tstats and tun->security allocations in tun_free_netdev when register_netdevice fails, because allocations occurred outside the paired ndo_init routine.

Why it matters to the business

Kernel memory corruption or crashes on Linux systems that create TUN/TAP interfaces, leading to denial of service and potential local privilege escalation.

How an attack unfolds

An attacker invokes tun_chr_ioctl sequences that allocate security and stats structures then force register_netdevice to return an error; the destructor tun_free_netdev runs twice, triggering the double-free detected by KASAN in selinux_tun_dev_free_security.

How to fix it

Upgrade to a kernel containing the fix that moves tstats and security allocations into tun_net_init; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm presence of tun_net_init routine paired with tun_free_netdev in drivers/net/tun.c and absence of the double-free KASAN report on error paths in register_netdevice.

Typical attack path

1. Open /dev/net/tun and issue TUNSETIFF ioctl to create interface
2. Trigger register_netdevice failure path after security and stats allocations
3. Cause tun_free_netdev to execute via netdev_run_todo
4. Trigger second free through SELinux hook or normal cleanup
5. Exploit resulting slab state for memory corruption or DoS

How to detect it

Search kernel logs for KASAN reports citing double-free or invalid-free in selinux_tun_dev_free_security or tun_free_netdev; inspect audit logs for unusual TUN ioctl sequences from untrusted processes.

• selinux_tun_dev_free_security+0x1a/0x20
• tun_free_netdev+0xe6/0x150
• BUG: KASAN: double-free or invalid-free
• tun_net_init

What your security team should do

• Apply the upstream fix or distribution kernel update immediately on all systems exposing /dev/net/tun
• Restrict unprivileged access to TUN device creation via cgroup or capability controls until patched
• Monitor for KASAN double-free reports involving selinux_tun_dev_free_security