CVE-2021-47148

What it actually does

Missing bounds check on user-supplied rss_context in otx2_set_rxfh_context allows buffer overflow and kernel memory corruption when called via ethtool_set_rxfh.

Why it matters to the business

Kernel memory corruption on affected systems can cause crashes, denial of service, or potential privilege escalation affecting network interface configuration and stability.

How an attack unfolds

An attacker with local access invokes ethtool_set_rxfh with a maliciously sized rss_context structure; the unchecked copy into kernel memory overwrites adjacent data structures.

How to fix it

Upgrade the affected kernel package to a version containing the bounds check fix; for AlmaLinux 8 the referenced mailman package update is 3:2.1.29-12.module_el8.5.0+26+48d4c9ee.2 or later equivalent kernel rebuild.

How to confirm the fix worked

Confirm the patched kernel is running, verify ethtool_set_rxfh rejects oversized rss_context values, and review dmesg for absence of prior overflow warnings.

Typical attack path

1. Obtain local user access on a system using the octeontx2-pf driver
2. Craft oversized rss_context data
3. Call ethtool_set_rxfh via netlink or ioctl
4. Trigger kernel memory overwrite leading to corruption or control-flow hijack

How to detect it

Review kernel logs for oops or corruption messages around ethtool calls, inspect audit logs for unusual ethtool invocations, and search process execution history for ethtool with non-standard RSS parameters.

What your security team should do

• Apply the kernel update immediately on all systems exposing the octeontx2-pf driver
• Restrict ethtool usage to privileged users via capabilities or SELinux
• Monitor EPSS trend and re-evaluate if exploit code appears