CVE-2021-47036: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47036 affects the Linux kernel's UDP packet handling functionality. The vulnerability was discovered in versions from 5.6 through 5.12.4, where if NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD features are enabled and UDP tunnels are available in the system, the udp_gro_receive() function could perform L4 aggregation at the outer UDP tunnel level for packets carrying UDP tunnel headers (NVD, Red Hat).

The vulnerability occurs in the UDP packet processing where udp_gro_receive() could incorrectly perform L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at the outer UDP tunnel level. This happens when packets carry UDP tunnel headers and either NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD features are enabled. The CVSS v3.1 base score is 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to inner protocol corruption. For example, when packets carry a VXLAN header, different VXLAN IDs could be ignored or aggregated to the same GSO packet. Additionally, inner headers might be ignored, causing TCP over VXLAN push packets to be held in the GRO engine until the next flush (Kernel Patch).

The vulnerability requires local access and low privileges to exploit. The attack complexity is low, and no user interaction is required. The scope is unchanged, meaning the impact is limited to the vulnerable component (NVD).

The issue has been fixed by skipping the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code paths if the current packet could land in a UDP tunnel, and instead letting udp_gro_receive() handle GRO via udp_sk(sk)->gro_receive. The fix has been implemented in the kernel patch, though it may skip GRO entirely for some packets in certain corner cases (Kernel Patch).