CVE-2021-47243

What it actually does

Out-of-bounds read in the TCP option parser within the cake qdisc when a TCP header length of 1 is encountered, allowing one byte to be read past the allocated buffer if the opcode is neither EOL nor NOP; additional doff validation prevents garbage header parsing.

Why it matters to the business

Network devices using the affected queue discipline may experience crashes, unexpected packet drops, or minor information leakage during traffic shaping, potentially disrupting service availability in high-throughput environments.

How an attack unfolds

An attacker crafts TCP packets with a minimal data-offset value and option bytes that force the parser loop to execute beyond the declared header length, triggering the out-of-bounds access when the packet is processed by the cake qdisc.

How to fix it

Update the Linux kernel to a version containing the referenced fix for sch_cake TCP option parsing and doff validation; apply the equivalent commit 7972565812ccb2a610a22911c54c3446f4171392 where systeminformation packages embed kernel networking components.

How to confirm the fix worked

Confirm the presence of the corrected cake_get_tcphdr and cake_get_tcpopt functions that enforce doff >= 5 and proper length checks before option parsing; test with crafted minimal-length TCP headers.

Typical attack path

1. Identify targets using the cake qdisc for traffic shaping
2. Craft TCP packets with data-offset of 1 and non-EOL/NOP option bytes
3. Send the packets toward the vulnerable interface
4. Trigger out-of-bounds read during option parsing in cake_get_tcpopt or cake_tcph_may_drop

How to detect it

Review kernel logs for sch_cake related oops or warnings during TCP option processing; inspect network packet captures for TCP headers with data-offset values below 5 bytes arriving on cake-managed interfaces.

What your security team should do

• Prioritize kernel upgrades on systems exposing cake qdisc to external traffic
• Monitor for downstream dependents of affected packages and schedule updates within standard change windows
• Disable cake qdisc on untrusted interfaces until patched if upgrade is delayed