CVE-2021-47129

What it actually does

nft_ct_expect_obj_eval calls nf_ct_ext_add on confirmed conntrack entries, violating the !nf_ct_is_confirmed requirement and triggering a warning in nf_conntrack_extend.c; the fix restricts expectation creation to the first packet only and skips template conntracks.

Why it matters to the business

Unpatched systems risk kernel warnings or instability during nftables ct helper usage, potentially affecting network filtering in containers and virtualized environments; the issue affects widely deployed AlmaLinux 8 packages with a large downstream footprint but low observed exploitation.

How an attack unfolds

An attacker with the ability to load or influence nftables rules creates a chain that invokes nft_ct_expect_obj_eval against an already-confirmed conntrack entry, causing the extension-add failure path to execute and surface the warning; no public weaponization is known.

How to fix it

Upgrade python-podman-api to 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39, libslirp to 4.3.1-1.module_el8.6.0+2876+9ed4eae2, and libslirp-devel to the same 4.3.1-1 version on AlmaLinux 8; apply the corresponding kernel update that contains the referenced netfilter fix.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed releases using rpm -q; confirm the kernel no longer contains the vulnerable nft_ct_expect_obj_eval path via source inspection or by reproducing the original call sequence without triggering the warning.

Typical attack path

1. Obtain privileges sufficient to install or modify nftables rules
2. Load a ruleset containing ct helper or expectation objects
3. Trigger rule evaluation on traffic that produces a confirmed conntrack entry
4. Observe kernel warning or system impact in nf_conntrack_extend

How to detect it

Search kernel logs for the exact WARNING string referencing nf_ct_ext_add+0x18e and the call trace containing nft_ct_expect_obj_eval and nf_ct_helper_ext_add; review nftables rule loads around the same timestamp.

• WARNING: CPU:.*at net/netfilter/nf_conntrack_extend.c:48 nf_ct_ext_add
• nft_ct_expect_obj_eval+0x1b8/0x1e0
• nf_ct_helper_ext_add+0x10/0x60

What your security team should do

• Prioritize patching the listed AlmaLinux 8 packages within the next maintenance window
• Audit nftables configurations for ct helper or expectation usage
• Monitor EPSS trend and re-evaluate if exploitation maturity increases