CVE-2021-47297

What it actually does

The flaw is an uninitialized-value read in caif_seqpkt_sendmsg when nr_segs equals zero, causing the function to access uninitialized stack memory from msg->msg_iter.iov instead of first checking whether any data buffers are present.

Why it matters to the business

Systems that expose or use the CAIF seqpacket socket interface may experience kernel crashes or undefined behavior; the issue is limited to niche cellular modem stacks and carries low exploitation probability.

How an attack unfolds

An attacker with local access invokes the sendmmsg or sendmsg syscall against a CAIF seqpacket socket, supplying an iovec with nr_segs set to zero. The kernel path reaches caif_seqpkt_sendmsg without validating the segment count, resulting in a read of uninitialized stack memory that may cause a crash or leak kernel data.

How to fix it

Upgrade to a Linux kernel containing the fix that adds an nr_segs check before dereferencing msg->msg_iter.iov in caif_seqpkt_sendmsg; apply the patch from the commit that resolved the uninit-value condition.

How to confirm the fix worked

Confirm the running kernel version includes the nr_segs guard in net/caif/caif_socket.c; recompile with KMSAN enabled and verify the warning no longer triggers on zero-segment sendmmsg calls to a CAIF seqpacket socket.

Typical attack path

1. Obtain local unprivileged access on a Linux system exposing CAIF sockets
2. Create or open a PF_CAIF/SOCK_SEQPACKET socket
3. Craft a struct msghdr with iov_iter containing nr_segs == 0
4. Call sendmsg or sendmmsg to trigger the vulnerable code path
5. Observe kernel oops or memory disclosure from the uninit-value access

How to detect it

Search kernel logs for KMSAN or BUG reports containing caif_seqpkt_sendmsg; inspect auditd or syscall logs for sendmmsg/sendmsg calls targeting PF_CAIF sockets with zero-length iovecs.

What your security team should do

• Identify hosts that load the caif module or expose CAIF sockets and prioritize kernel upgrades
• Disable the caif module via modprobe blacklist if the interface is unused
• Monitor for kernel oops reports referencing caif_seqpkt_sendmsg