CVE-2021-47199

What it actually does

The flaw causes repeated allocation of mod hdr actions for CT clear without proper release during reoffload triggered by neigh updates on flows with CT and encap, leading to memory leak and exhaustion of mod hdr action slots.

Why it matters to the business

Systems using affected kernel drivers may experience memory leaks and resource exhaustion in network processing, potentially leading to performance degradation or crashes, with high prevalence in downstream dependents increasing exposure risk.

How an attack unfolds

An attacker triggers network flows involving connection tracking and encapsulation; neighbor update events cause repeated unoffload/reoffload cycles, each time adding duplicate CT clear mod hdr actions until the maximum is reached and memory is leaked.

How to fix it

Update to fixed versions: thunderbird (Debian:11) 1:91.4.1-1~deb11u1, thunderbird (Debian:12) 1:91.4.0-1, thunderbird (Debian:13) 1:91.4.0-1, firefox-esr (Debian:11) 91.4.1esr-1~deb11u1, firefox-esr (Debian:12) 91.4.0esr-1, firefox-esr (Debian:13) 91.4.0esr-1; move CT clear mod acts allocation into parsing phase and release via flow_put().

How to confirm the fix worked

Confirm kernel patch applied by checking source for allocation moved to parsing actions phase and release in flow_put(); test with CT+encap flows and neigh updates to verify no repeated allocations or leaks.

Typical attack path

1. Establish flows with CT and encap actions on mlx5e devices
2. Trigger neigh update events to force flow unoffload and reoffload
3. Repeat cycles to accumulate mod hdr allocations and exhaust resources

How to detect it

Review kernel logs for repeated krealloc calls in mlx5e_mod_hdr_alloc during tc offload; inspect for memleak patterns in mlx5_tc_ct_flow_offload paths after neigh updates.

• mlx5e_mod_hdr_alloc
• mlx5_tc_ct_flow_offload
• mlx5e_tc_encap_flows_add

What your security team should do

• Prioritize upgrade of affected packages to listed fixed versions immediately given 923 days since publication
• Monitor EPSS trend (stable at 0.0020) and reassess if threat actors emerge
• Audit systems for mlx5e CT offload usage and apply mitigations if patching delayed