CVE-2021-47241

What it actually does

Miscalculation of netlink message payload length for ETHTOOL_MSG_STRSET_GET due to missing outer nest accounting for ETHTOOL_A_STRSET_STRINGSETS, triggering a kernel warning when reply size is exact, string sets are per-device, and device names are long enough.

Why it matters to the business

Kernel warnings or instability when querying network device private flags or string sets on systems with long device names, potentially affecting network configuration tools and system reliability in production environments.

How an attack unfolds

An attacker or fuzzer issues an ETHTOOL_MSG_STRSET_GET netlink request targeting a per-device string set on an interface whose name meets the length threshold; the missing nest length causes the calculated payload to be insufficient, resulting in the warning at ethnl_default_doit.

How to fix it

Apply the upstream fix that correctly accounts for the outer nest when calculating reply size for string-set messages; update to a Linux kernel version containing the resolution for this ethtool strset length bug.

How to confirm the fix worked

Confirm the patch is present by inspecting net/ethtool/strset.c for correct outer-nest length inclusion; test by running ethtool -P on interfaces with names >=12 characters and verify absence of the payload-length warning.

Typical attack path

1. Obtain ability to send netlink messages to the kernel (local user, container, or via ethtool command)
2. Identify or create a network interface whose name is at least 12 characters
3. Issue ETHTOOL_MSG_STRSET_GET requesting string sets without skb rounding
4. Trigger the length miscalculation and warning path in ethtool netlink handling

How to detect it

Search kernel logs for the exact warning text mentioning calculated message payload length and ethnl_default_doit; correlate with ethtool strset get operations on long-named interfaces.

What your security team should do

• Prioritize kernel updates on systems exposing ethtool netlink interfaces to untrusted users or containers
• Monitor for the specific kernel warning string in system logs
• Restrict unprivileged access to ethtool and netlink sockets where feasible