CVE-2021-47276

What it actually does

The flaw causes ftrace_bug() to directly dereference a potentially invalid IP address during error reporting in ftrace_init(), resulting in a kernel panic on architectures such as arm64 when the address does not point to valid memory.

Why it matters to the business

Kernel crashes can occur during boot or tracing setup, leading to system instability, downtime, and potential data loss in environments relying on ftrace for debugging or performance analysis.

How an attack unfolds

An attacker or misbehaving code triggers ftrace initialization to fail with an invalid IP address; the error path then attempts an unsafe read of that address, causing the kernel to panic rather than handling the fault gracefully.

How to fix it

Upgrade the Linux kernel to a version containing the fix that replaces the direct read with copy_from_kernel_nofault() to safely handle potential faults.

How to confirm the fix worked

Verify the kernel source contains the updated ftrace_bug() implementation using copy_from_kernel_nofault(), or confirm the running kernel version includes the commit resolving this issue.

Typical attack path

1. Cause ftrace initialization to encounter a bad IP address
2. Return -EINVAL from the failing path
3. Invoke ftrace_bug() which performs a direct read of the invalid address
4. Trigger kernel panic due to invalid memory access

How to detect it

Inspect kernel panic logs and dmesg output for messages originating from ftrace_bug() involving invalid IP addresses or memory faults during initialization.

What your security team should do

• Apply the latest stable kernel updates containing the ftrace fix
• Reboot systems after patching to ensure ftrace initialization uses the safe memory access path
• Monitor kernel logs for ftrace-related panics during boot