CVE-2021-47397

What it actually does

Missing null check after skb_header_pointer in sctp_rcv_ootb allows null pointer dereference when processing out-of-the-blue SCTP packets, resulting in kernel panic via KASAN null-ptr-deref.

Why it matters to the business

Linux systems using SCTP may suffer sudden kernel crashes or service outages triggered by network traffic, increasing downtime risk on servers handling SCTP protocols.

How an attack unfolds

Attacker crafts an IPv6 SCTP packet that reaches sctp_rcv and sctp_rcv_ootb where skb_header_pointer returns NULL; the unchecked pointer is dereferenced causing immediate kernel fault during network stack processing.

How to fix it

Apply the upstream kernel patch that adds the NULL check before using skb_header_pointer in sctp_rcv_ootb; rebuild and deploy updated kernel images across affected systems.

How to confirm the fix worked

Confirm the fix by inspecting net/sctp/input.c for the added NULL return check in sctp_rcv_ootb or verify the running kernel contains commit addressing the syzbot-reported null-ptr-deref.

Typical attack path

1. Craft malicious IPv6 SCTP packet targeting out-of-the-blue handling
2. Deliver packet to trigger sctp6_rcv and ip6_input path
3. Force skb_header_pointer to return NULL in sctp_rcv_ootb
4. Execute null dereference leading to kernel panic

How to detect it

Search kernel logs and dmesg for KASAN null-ptr-deref reports citing sctp_rcv_ootb or sctp_rcv during IRQ context; correlate with IPv6 packet receive traces.

• sctp_rcv_ootb
• KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
• RIP: sctp_rcv+0x1d84
• sctp6_rcv+0x38/0x60

What your security team should do

• Inventory systems exposing SCTP over IPv6
• Prioritize kernel updates on internet-facing or high-value hosts
• Enable kernel crash logging and monitoring for SCTP-related oops
• Consider disabling SCTP if not required