CVE-2021-47244

What it actually does

Out-of-bounds read of one byte in mptcp_get_options when a TCP option of length 1 has an opcode other than EOL or NOP, causing the parser to read past the supplied option buffer.

Why it matters to the business

Systems using MPTCP may experience kernel instability, crashes, or limited memory disclosure during network processing, increasing operational risk for high-throughput or multi-path network workloads.

How an attack unfolds

An attacker crafts TCP segments containing MPTCP options whose length field is set to 1 and whose opcode is neither EOL nor NOP; when the kernel processes the segment the parser enters the loop and reads one byte beyond the option data, triggering the flaw.

How to fix it

Apply the upstream kernel commit that corrects the MPTCP option length check (inspired by 9609dad263f8) or upgrade to a kernel release containing the fix for this issue.

How to confirm the fix worked

Confirm the presence of the corrected length check in mptcp_get_options by inspecting source or verifying the running kernel contains the referenced patch; test with crafted length-1 options to ensure no out-of-bounds access occurs.

Typical attack path

1. Attacker positions a network path that delivers packets to a target system using MPTCP.
2. Attacker sends a TCP packet containing a specially formed MPTCP option with length=1 and an opcode other than EOL/NOP.
3. Kernel MPTCP option parser reads the opcode and then one additional byte past the option boundary.
4. Resulting out-of-bounds read may leak a byte of kernel stack memory or cause a crash.

How to detect it

Review kernel logs for MPTCP-related oops or panic entries around the time of unusual TCP option processing; no reliable post-exploitation artifacts are produced by the read alone.

What your security team should do

• Prioritize kernel updates on all systems that enable MPTCP.
• Disable MPTCP on hosts where multi-path TCP is not required.
• Monitor upstream stable kernel releases for the backported fix.