CVE-2021-47363

What it actually does

A division by zero occurs in the kernel's nexthop path selection logic when a resilient nexthop group with zero buckets is visible to the data path during replacement operations.

Why it matters to the business

Systems may experience unexpected kernel crashes or reboots when performing network routing configuration changes involving resilient nexthop groups, potentially disrupting network connectivity and services.

How an attack unfolds

An attacker with the ability to trigger repeated replacements of resilient nexthop groups without specifying bucket counts can cause the kernel to allocate a stub table with zero buckets. If this table becomes visible to the data path during traffic forwarding, it triggers a divide-by-zero error leading to a system crash.

How to fix it

Apply the kernel patch that ensures the stub table is assigned only after the group is no longer in use by the data path. Upgrade to a Linux kernel version that includes the fix for this issue.

How to confirm the fix worked

Run the fib_nexthop.sh torture tests to verify no division by zero occurs. Monitor for absence of related kernel oops messages.

Typical attack path

1. Configure or replace a resilient nexthop group in a loop without bucket specification
2. Forward traffic through the group simultaneously
3. Trigger the condition where old group is assigned stub table
4. Cause division by zero in nexthop_select_path

How to detect it

Examine kernel logs for 'divide error' panics with stack traces involving nexthop_select_path, fib_select_multipath, and related IP routing functions.

• divide error: 0000 [#1] PREEMPT SMP KASAN
• nexthop_select_path+0x2d2/0x1a80
• fib_select_multipath+0x79b/0x1530

What your security team should do

• Prioritize kernel updates for systems using advanced multipath routing
• Test routing configurations in lab environments before production deployment
• Monitor kernel logs for division errors in networking code