CVE-2021-47243: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47243 affects the Linux kernel's TCP option parser in the cake qdisc (Common Applications Kept Enhanced) functionality. The vulnerability was discovered in May 2024 and involves an out-of-bounds read condition in the cake_get_tcpopt and cake_tcph_may_drop functions. The affected versions include Linux kernel versions from 4.19 up to 5.13-rc6 (NVD).

The vulnerability occurs when parsing TCP options in the cake qdisc component. When the length parameter is 1, the execution flow enters a loop that reads one byte of the opcode. If the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it attempts to read one more byte, which exceeds the allocated length of 1. Additionally, there was a potential for reading garbage values as TCP header if the doff value was smaller than 5 (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 7.1 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (NVD).

The vulnerability could lead to an out-of-bounds read condition, potentially allowing an attacker to access memory outside the intended buffer. This could result in information disclosure and system crashes. The vulnerability affects the confidentiality and availability of the system, as indicated by the CVSS metrics showing high impacts for confidentiality (C:H) and availability (A:H) (NVD).

The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and low privileges (PR:L). No user interaction (UI:N) is required to exploit this vulnerability. The scope is unchanged (S:U), meaning the impact is limited to the vulnerable component (NVD).

The vulnerability has been fixed through a patch that adds length validation before reading the second byte and validates the doff value in cake_get_tcphdr. The fix was inspired by a similar patch addressing TCP option parsing in the IPv4 stack. System administrators should update to patched kernel versions that include the fix (Kernel Patch).