CVE-2021-47309

What it actually does

skb_tunnel_info() returns an unvalidated lwtstate->data pointer cast as ip_tunnel_info, allowing incompatible types such as mpls_iptunnel_encap to be dereferenced and causing slab-out-of-bounds reads when VXLAN or similar tunnel code processes the result.

Why it matters to the business

Linux-based network devices and servers may experience kernel crashes or memory corruption during packet forwarding involving MPLS, VXLAN, or other lightweight tunnels, resulting in denial of service and potential system instability under load.

How an attack unfolds

An attacker sends crafted IP packets that traverse an MPLS tunnel followed by VXLAN encapsulation; the kernel path through lwtunnel_xmit and vxlan_xmit_one invokes skb_tunnel_info without type validation, triggering the out-of-bounds read.

How to fix it

Upgrade to a Linux kernel containing the upstream fix for skb_tunnel_info validation; rebuild and reboot affected systems with the corrected kernel.

How to confirm the fix worked

Confirm the kernel version includes the commit that adds type validation inside skb_tunnel_info before returning lwtstate->data; run network stress tests involving VXLAN over MPLS paths and verify absence of KASAN reports.

Typical attack path

1. Attacker crafts packets that force MPLS encapsulation via mpls_iptunnel
2. Packets are forwarded through a VXLAN device that calls vxlan_get_route
3. skb_tunnel_info is invoked and returns an incompatible lwtstate->data pointer
4. Kernel dereferences the pointer as ip_tunnel_info, causing KASAN-detected out-of-bounds access

How to detect it

Inspect kernel logs for KASAN slab-out-of-bounds reports referencing vxlan_get_route, vxlan_xmit_one, or skb_tunnel_info; correlate with network traffic containing mixed MPLS and VXLAN headers.

What your security team should do

• Prioritize kernel updates on all systems performing MPLS or VXLAN encapsulation
• Monitor for kernel oops or KASAN reports in vxlan and lwtunnel code paths
• Apply the fix before the next maintenance window given the memory corruption class