CVE-2021-47162

What it actually does

Use-after-free in Linux kernel TIPC message reassembly when tipc_buf_append appends a frag skb to a frag_list originating from pskb_copy or pskb_may_pull on a cloned skb, causing the frag to be referenced by multiple skbs after only one skb_get.

Why it matters to the business

Denial of service via kernel crashes or panics on Linux systems using TIPC over macvlan or similar devices; potential for local privilege escalation or remote code execution in kernel context on affected network paths, disrupting services and requiring urgent patching.

How an attack unfolds

Attacker sends specially crafted TIPC messages that exercise the reassembly path in tipc_buf_append on a head skb created via pskb_copy or updated via pskb_may_pull; the incorrectly shared frag skb triggers use-after-free when later operations such as skb_clone or skb_copy_datagram_iter access it, as reported in macvlan and be2net scenarios. Threat actors in 2024 zero-day campaigns have targeted similar Linux kernel networking flaws for espionage and financial gain.

How to fix it

Apply the upstream fix that calls __skb_linearize on the head skb inside tipc_buf_append before skb_unshare; upgrade to a patched Linux kernel version containing commit resolving the frag_list reference-counting issue.

How to confirm the fix worked

Verify the presence of the linearization change in tipc_buf_append in the running kernel source or by checking kernel version against the fixed release; reproduce the reported macvlan/TIPC test cases to confirm absence of BUG at skbuff.c:1970 or slub.c:305.

Typical attack path

1. Craft TIPC datagrams that force frag_list cloning via pskb_copy
2. Trigger tipc_buf_append to attach a new frag skb to the shared list
3. Cause subsequent skb operations (clone, datagram copy, or receive) to dereference the freed frag
4. Achieve kernel panic, memory corruption, or code execution

How to detect it

Search kernel logs and dmesg for BUG reports at net/core/skbuff.c, mm/usercopy.c, or mm/slub.c during TIPC receive or macvlan processing; inspect crash dumps for tipc_buf_append and skb_clone call stacks.

• kernel BUG at net/core/skbuff.c:1970
• kernel BUG at mm/usercopy.c:102
• kernel BUG at mm/slub.c:305
• tipc_recvmsg
• macvlan_broadcast
• macvlan_process_broadcast

What your security team should do

• Patch Linux kernels to a version containing the TIPC skb linearization fix as soon as available
• Disable or isolate TIPC interfaces on systems where not required
• Monitor kernel logs for skbuff and slub BUG reports involving tipc_recvmsg or macvlan
• Harden network device configurations that use macvlan or be2net with TIPC