CVE-2021-47186

What it actually does

Missing null check after kmemdup in TIPC allows null pointer dereference in tipc_crypto_key_xmit when memory allocation fails.

Why it matters to the business

Systems using the TIPC protocol risk kernel crashes and loss of availability, potentially disrupting cluster or inter-process communications in affected environments.

How an attack unfolds

An attacker sends crafted network packets targeting the TIPC key transmission path, forcing a kmemdup failure that leads to null dereference and system instability.

How to fix it

Apply the upstream kernel commit that adds the missing null-pointer check after kmemdup in the TIPC crypto code; rebuild and deploy the patched kernel.

How to confirm the fix worked

Inspect the TIPC source for the added null check after kmemdup, or run the original syzkaller reproducer to confirm the crash is no longer reproducible.

Typical attack path

1. Send specially crafted TIPC protocol messages over the network
2. Trigger memory allocation failure inside the vulnerable kmemdup call
3. Reach the unchecked null pointer dereference in tipc_crypto_key_xmit

How to detect it

Review kernel logs and crash dumps for null pointer dereference traces referencing tipc_crypto_key_xmit or kmemdup failures in the TIPC subsystem.

• tipc_crypto_key_xmit
• kmemdup.*tipc
• null pointer dereference.*TIPC

What your security team should do

• Prioritize kernel updates on all systems exposing TIPC
• Disable the TIPC module if the protocol is unused
• Monitor kernel logs for TIPC-related oops and panics