CVE-2021-47336

What it actually does

The missing count > SMK_CIPSOMAX validation in smk_set_cipso() for non-SMK_FIXED24_FMT cases allows a user to supply an oversized write buffer to smackfs, bypassing the intended length restriction and enabling out-of-bounds memory access in the kernel.

Why it matters to the business

On systems using the Smack LSM, an unprivileged local user could trigger kernel memory corruption, leading to crashes, privilege escalation, or full system compromise; the low EPSS and lack of known exploitation reduce immediate urgency but the flaw remains in any unpatched kernel containing the original commit.

How an attack unfolds

An attacker with write access to smackfs opens the cipso file, selects a format other than SMK_FIXED24_FMT, and supplies a byte count larger than SMK_CIPSOMAX; the kernel copies the oversized data without the missing bounds check, corrupting adjacent kernel structures.

How to fix it

Apply the upstream patch from commit 07571157c91b98ce1a4aa70967531e64b78e8346 (or any later kernel that includes it) and rebuild/boot the fixed kernel; ensure all Smack-enabled distributions receive the update.

How to confirm the fix worked

Confirm the presence of the bounds check for all formats in smk_set_cipso() by inspecting the source or running a kernel that reports the fixed commit; test by attempting an oversized write and verifying it is now rejected.

Typical attack path

1. Obtain local unprivileged shell on a Smack-enabled Linux system
2. Locate and open /sys/fs/smackfs/cipso (or equivalent smackfs mount)
3. Issue a write(2) with format != SMK_FIXED24_FMT and count > SMK_CIPSOMAX
4. Trigger kernel path that performs the unchecked copy, causing memory corruption
5. Leverage corruption for privilege escalation or denial of service

How to detect it

Inspect kernel logs for oops or panic entries referencing smackfs or smk_set_cipso; review audit logs for unusual write activity to smackfs cipso interface by non-root processes.

What your security team should do

• Prioritize patching Smack-enabled kernels within normal maintenance windows given low EPSS and no KEV listing
• Audit systems for Smack LSM usage and remove the LSM if not required
• Monitor kernel update channels for backports of the 2021 fix