CVE-2021-47496

What it actually does

Sign error in tls_err_abort callers allows negative error codes to be stored directly in sk->sk_err; later code negates the value and interprets it as a positive byte count, producing integer underflow on buffer lengths and subsequent out-of-bounds accesses.

Why it matters to the business

Kernel memory corruption on systems that enable kernel TLS can cause crashes, data corruption, or potential elevation of privilege during network I/O, increasing downtime and incident-response costs for any deployment that uses kTLS.

How an attack unfolds

An attacker opens a TLS socket, forces a crypto request to fail with a negative error code, and relies on the sign-mismatch path through splice_from_pipe_feed and tls_sw_do_sendpage to turn the stored error into a large positive length; the resulting underflow yields bogus buffer offsets that the attacker can steer toward memory corruption.

How to fix it

Update the Linux kernel to a version containing the centralized sign-correcting tls_err_abort implementation and the added warning; rebuild and reboot with the patched kernel; consider disabling kTLS via sysctl or module unload until the update is complete.

How to confirm the fix worked

Confirm the tls_err_abort function now always stores a positive error and emits a warning on misuse; run regression tests that deliberately inject crypto errors into kTLS paths and verify no underflow or corruption occurs.

Typical attack path

1. Open a TLS socket and enable kTLS offload
2. Induce a crypto-engine failure returning a negative errno
3. Trigger splice or sendpage operations that read sk->sk_err
4. Cause positive-value misinterpretation leading to length underflow
5. Leverage resulting invalid addresses for memory corruption or crash

How to detect it

Search kernel logs for TLS error paths, unexpected positive return values from splice/sendpage, and any oops or slab corruption messages that reference net/tls or tls_sw_do_sendpage; correlate with processes performing heavy splice or sendfile operations over TLS sockets.

What your security team should do

• Prioritize kernel upgrade on all hosts that have CONFIG_TLS enabled
• Audit workloads for kTLS usage and disable where feasible
• Add kernel panic and OOPS monitoring for TLS-related stack traces
• Review downstream distributions for backported fixes