CVE-2021-47240

What it actually does

Integer wrap in size calculation for qrtr_hdr allows ALIGN(size,4) to become zero; subsequent length check passes and skb_put_data performs an out-of-bounds read from the allocated skb.

Why it matters to the business

Potential leakage of adjacent kernel memory contents over the QRTR interface increases risk of information disclosure that could be used to bypass other protections; low exploitability limits immediate operational impact but still requires prompt patching on affected systems.

How an attack unfolds

An attacker crafts a QRTR packet whose header contains size=0xfffffffd and len equal to hdrlen; the flawed check passes, causing the kernel to read past the end of the allocated data buffer when copying payload bytes.

How to fix it

Upgrade memorysafety/sudo-rs to commit 195d6f851904ab00357f040eef35e31abaebbe1b or trifectatechfoundation/sudo-rs to commit bfdbda22968e3de43fa8246cab1681cfd5d5493d; rebuild and redeploy the affected packages.

How to confirm the fix worked

Confirm the updated commit is present in the running binary or source tree; exercise qrtr_endpoint_post paths with both valid and boundary-case size values and verify no slab-out-of-bounds warnings are emitted.

Typical attack path

1. Send a malformed QRTR datagram with size field set to 0xfffffffd
2. Trigger qrtr_endpoint_post on the receiving node
3. Bypass the length validation due to wrap-around in ALIGN
4. Perform out-of-bounds memory read via skb_put_data

How to detect it

Search kernel logs for slab-out-of-bounds Read messages referencing qrtr_endpoint_post; inspect network traces for QRTR packets whose reported size is near UINT32_MAX and whose total length equals only the header size.

• slab-out-of-bounds Read in qrtr_endpoint_post
• qrtr_hdr size 4294967293
• skb_put_data call with size near 0xfffffffd

What your security team should do

• Apply the listed commit upgrades immediately on all systems exposing QRTR sockets
• Monitor EPSS trend and re-evaluate if exploit code appears
• Add kernel memory-safety tooling (KASAN, etc.) to CI for similar net/ subsystems