CVE-2021-47152: 
Linux Kernel vulnerability analysis and mitigation

A data stream corruption vulnerability was discovered in the Linux kernel's MPTCP (Multipath TCP) implementation. The vulnerability (CVE-2021-47152) was found in the mptcp_frag_can_collapse_to() function, which incorrectly assumed that only MPTCP would use a given page_frag. This issue could result in data stream corruption when other protocols, such as plain TCP, allocate page fragments (Kernel Git).

The vulnerability stems from the mptcp_frag_can_collapse_to() function's assumption about page fragment usage. When other protocols (like plain TCP) allocate page fragments, the system could end up re-using already allocated memory for mptcp_data_frag. The issue was particularly noticeable when forcing a TCP transparent proxy to use the MPTCP protocol for inbound connections. The vulnerability has been assigned a CVSS v3 score of 5.5 with attack vector: Local, attack complexity: Low, privileges required: Low, user interaction: None, scope: Unchanged, and impact primarily affecting availability (Red Hat CVE).

The vulnerability may result in data stream corruption and potential system crashes. The primary impact is on system availability, with no direct effect on confidentiality or integrity of the system (Red Hat CVE).

The vulnerability requires local access with low privileges to exploit. The attack complexity is considered low, though it requires specific conditions involving TCP transparent proxy usage with MPTCP protocol (Red Hat CVE).

The issue has been fixed by ensuring that the to-be-expanded data fragment is located at the current page frag end. The fix was implemented by modifying the mptcp_frag_can_collapse_to() function to properly validate the data fragment location (Kernel Git).