CVE-2021-47304

What it actually does

Double initialization of TCP congestion control modules without an intervening release call, allowing modules that allocate memory during init (such as CDG) to leak memory.

Why it matters to the business

Memory exhaustion on Linux systems under crafted TCP workloads can degrade performance, trigger OOM conditions, or cause instability in network-heavy services; low exploit likelihood and no known ransomware use reduce immediate urgency despite the long window since disclosure.

How an attack unfolds

An attacker crafts a TCP socket sequence using TFO connect followed by setsockopt(TCP_CONGESTION) while the socket is in SYN_SENT state, then completes the handshake to force tcp_init_transfer to reset the already-initialized congestion control state, bypassing the release step and leaking memory in affected modules.

How to fix it

Apply the upstream kernel commit that preserves icsk_ca_initialized across tcp_init_transfer calls; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Confirm the presence of the fix by inspecting tcp_init_transfer in the kernel source for the icsk_ca_initialized guard, or verify the running kernel version contains the resolved change.

Typical attack path

1. Create TCP socket
2. Initiate TFO connect via sendto()
3. While in TCP_SYN_SENT, invoke setsockopt(TCP_CONGESTION) to trigger first initialization
4. Allow connection establishment to invoke tcp_init_transfer and force second initialization without release
5. Repeat to accumulate leaks in memory-allocating congestion control modules

How to detect it

Review kernel logs and memory accounting for repeated congestion-control init patterns without matching release calls; correlate with TFO and setsockopt activity in network traces or system call auditing.

What your security team should do

• Prioritize kernel updates on high-traffic or externally facing Linux hosts
• Audit use of non-default congestion control modules that allocate memory
• Monitor kernel memory statistics for unexplained growth tied to TCP sockets