CVE-2021-47109

What it actually does

The flaw permits an unbounded accumulation of NUD_NOARP neighbour entries on IFF_POINTOPOINT IPv6 interfaces, causing the neighbour table to overflow and block insertion of legitimate entries for valid connections.

Why it matters to the business

Systems using affected network configurations can lose IPv6 connectivity, resulting in service outages for clustered or point-to-point applications until the table is cleared or the system is restarted.

How an attack unfolds

An attacker with network access to an IFF_POINTOPOINT IPv6 link sends repeated packets that trigger creation of NUD_NOARP entries; after the neighbour table fills, subsequent legitimate neighbour resolutions fail, denying service to valid peers.

How to fix it

Upgrade corosync, corosync-vqsim, corosynclib-devel, and spausedd packages on AlmaLinux 8 to version 3.0.3-4.el8 or later; apply the corresponding kernel neighbour-table fix if a backport is available for the running kernel.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases; confirm the neighbour-table garbage-collection change is present by inspecting kernel source or running a test that attempts to populate NUD_NOARP entries beyond the table limit.

Typical attack path

1. Identify or create an IFF_POINTOPOINT IPv6 interface on the target
2. Transmit crafted IPv6 packets that cause NUD_NOARP neighbour entries to be added
3. Continue flooding until the neighbour table reaches capacity
4. Observe that new valid connections are refused due to table exhaustion

How to detect it

Review system logs for neighbour-table allocation failures or IPv6 neighbour-resolution errors; inspect /proc/net/arp or neighbour cache statistics for unusually high counts of NUD_NOARP entries on point-to-point interfaces; correlate with network traffic patterns that coincide with connectivity loss.

What your security team should do

• Immediately schedule the package upgrade on all AlmaLinux 8 hosts running the listed corosync components
• Prioritize hosts that expose IFF_POINTOPOINT IPv6 interfaces
• Monitor neighbour-table size via /proc/net/arp or equivalent tooling until patches are applied
• Review network configurations to limit exposure of point-to-point IPv6 links where feasible