CVE-2021-47352

What it actually does

Missing validation for used length values supplied by an untrusted virtio device in the virtio-net driver, allowing data corruption or loss.

Why it matters to the business

Potential network data integrity issues in virtualized environments using affected Linux kernels; low operational urgency given low EPSS, no KEV listing, and no known ransomware use despite 882 days since publication.

How an attack unfolds

An attacker with the ability to emulate or compromise a virtio device supplies crafted used length values that the driver accepts without checks, resulting in memory corruption or packet handling errors.

How to fix it

Upgrade affected systems to a kernel containing the validation fix; for listed gitlab-org/gitlab packages apply the update to commit 7fc27fe692abccaed7e2e0ebfea2aadf5140593f.

How to confirm the fix worked

Confirm kernel version includes the virtio-net used length validation patch; review driver source for the added length checks and test with malicious device emulation.

Typical attack path

1. Position malicious or compromised virtio device in guest or hypervisor environment
2. Transmit network traffic containing invalid used length fields
3. Trigger driver processing that corrupts or drops data

How to detect it

Review system logs for virtio-net driver errors or anomalies around packet processing; examine hypervisor or guest logs for unexpected device behavior after the 2024-05-21 publication date.

What your security team should do

• Prioritize patching systems that rely on virtio networking in production virtualized workloads
• Monitor EPSS trend and any new exploit maturity signals
• Apply the referenced gitlab-org/gitlab commit where applicable