CVE-2021-47464

What it actually does

Null-pointer dereference in audit_filter_rules when ctx is unexpectedly null, resulting in kernel memory corruption or crash.

Why it matters to the business

Local attackers may crash affected systems or escalate privileges, causing downtime and potential data exposure on Linux deployments; low exploitation likelihood but high severity if triggered.

How an attack unfolds

An attacker with local access crafts audit rules that reach the vulnerable path in audit_filter_rules with a null ctx, triggering the dereference to achieve denial of service or memory corruption for further exploitation.

How to fix it

Update to fixed kernel versions; for listed packages apply wordpress (Debian:11) 5.7.11+dfsg1-0+deb11u1, wordpress (Debian:12) 6.1.6+dfsg1-0+deb12u1, wordpress (Debian:13) 6.3.2+dfsg1-1, or wordpress GIT commit 03505cd7f9898a337013d638fffb15fb6237ac99.

How to confirm the fix worked

Verify kernel version matches or exceeds the fixed releases and confirm absence of the null dereference path via source inspection or runtime audit rule testing.

Typical attack path

1. Obtain local access to the system
2. Load or trigger audit subsystem with crafted filter rules
3. Cause null ctx condition in audit_filter_rules
4. Trigger kernel panic or memory corruption
5. Escalate to higher privileges or persist via crash handling

How to detect it

Review kernel logs for audit-related oops or null dereference messages; inspect audit rule loading events around system crashes.

What your security team should do

• Apply the listed fixed package versions immediately on all affected systems
• Monitor for local privilege escalation attempts targeting the audit subsystem
• Restrict local user access where possible until patches are deployed