CVE-2021-47245

What it actually does

Out-of-bounds memory read in the TCP option parser within the synproxy module, allowing access to one byte beyond allocated buffer when processing malformed TCP options with length 1.

Why it matters to the business

Potential system crashes or information disclosure on Linux-based network devices and servers handling SYN proxying, leading to service disruption or exposure of sensitive memory contents.

How an attack unfolds

An attacker sends a specially crafted TCP packet with a single-byte option that is neither EOL nor NOP, triggering the parser to read beyond bounds in the synproxy code path.

How to fix it

Apply the upstream kernel patch that adds an early return when length < 0 and prevents the extra byte read in synproxy_parse_options.

How to confirm the fix worked

Confirm the fix is present by inspecting the synproxy_parse_options function for the length guard or by testing with crafted single-byte option packets that no longer produce OOB access.

Typical attack path

1. Craft TCP packet with anomalous option length of 1 and non-EOL/NOP opcode
2. Send packet targeting a synproxy-enabled path in the Linux kernel
3. Trigger OOB read during synproxy_parse_options execution

How to detect it

Inspect kernel logs and dmesg for synproxy_parse_options references, stack traces mentioning TCP option parsing, or OOB access warnings.

What your security team should do

• Update Linux kernel to a version containing the referenced fix commit
• Review and restrict use of synproxy in high-exposure network paths
• Monitor kernel logs for related parsing errors or crashes