CVE-2021-47293

What it actually does

The tcf_skbmod_act function in the Linux kernel net/sched module performs MAC address swapping and other modifications without first validating that the packet uses Ethernet framing at layer 2, leading to memory corruption of non-Ethernet packets such as those on CAN or other virtual interfaces.

Why it matters to the business

Systems using Linux traffic-control skbmod actions on non-Ethernet network interfaces may experience silent packet corruption, resulting in unreliable network communications, application failures, or loss of connectivity on affected devices.

How an attack unfolds

An attacker with sufficient privileges to configure traffic-control filters on a Linux host creates a non-Ethernet interface and attaches an HTB qdisc with a matchall filter that invokes the skbmod action; the kernel then overwrites packet data assuming Ethernet headers that do not exist, corrupting every subsequent packet processed by that filter.

How to fix it

Upgrade the Linux kernel to a version that contains the upstream fix for CVE-2021-47293; until patches are applied, avoid configuring skbmod actions on any non-Ethernet interfaces and audit existing tc filter configurations for unsafe use of skbmod.

How to confirm the fix worked

Confirm the installed kernel contains the commit that adds the non-Ethernet check in tcf_skbmod_act; test by attempting to attach an skbmod action to a vcan or similar interface and verifying that the operation is now rejected or skipped.

Typical attack path

1. Obtain privileges to run tc commands on the target host
2. Create or identify a non-Ethernet interface (e.g., vcan)
3. Attach an HTB or other qdisc to the interface root
4. Install a filter using protocol ip with the skbmod swap mac action
5. Observe or trigger traffic that matches the filter, causing packet corruption

How to detect it

Review system logs for tc filter additions involving skbmod on non-Ethernet devices; inspect kernel ring buffer messages around interface creation of types such as vcan or similar; correlate with packet loss or corruption symptoms on those interfaces.

What your security team should do

• Prioritize kernel updates on any hosts that expose traffic-control configuration to untrusted users
• Inventory systems for tc filter rules that reference skbmod and restrict such rules to Ethernet-only interfaces
• Monitor for new kernel releases and apply fixes within standard change windows given low EPSS and absence from KEV