CVE-2021-47221

What it actually does

SLUB redzoning checks from s->object_size instead of s->inuse, allowing freelist pointer writes beyond object_size for caches smaller than 24 bytes and corrupting the redzone when slub_debug=Z is active.

Why it matters to the business

Kernel memory integrity checks can be bypassed or trigger false positives on systems using affected SLUB configurations, increasing risk of undetected corruption or instability during debugging.

How an attack unfolds

An attacker with the ability to influence small-object allocations in a kernel with slub_debug redzoning enabled triggers repeated allocations that write the freelist pointer past the object boundary, corrupting the adjacent redzone bytes.

How to fix it

Upgrade affected packages to the fixed versions 7.14.7+dfsg-1 or later; rebuild kernels with corrected SLUB offset calculations if custom configurations are in use.

How to confirm the fix worked

Confirm the patch by inspecting mm/slub.c for the adjusted offset calculation that keeps the freelist pointer within s->object_size; run slub_debug=ZF tests on small-object caches to verify absence of redzone overwrites.

Typical attack path

1. Enable or rely on slub_debug=Z redzoning on a vulnerable kernel build
2. Trigger creation or use of a cache whose object size is less than 24 bytes
3. Perform allocations that cause the freelist pointer to be stored at an offset exceeding object_size
4. Observe or exploit the resulting redzone overwrite for further memory corruption

How to detect it

Search kernel logs for SLUB redzone violation messages containing "Right Redzone overwritten" or offset values near 1500 bytes; examine slab objects for freelist pointers written past the declared object_size boundary.

What your security team should do

• Apply the vendor-supplied kernel or package update immediately on all affected systems
• Audit any custom kernels or modules that create small SLUB caches while redzoning is enabled
• Monitor EPSS and KEV updates for any change in exploit maturity