CVE-2021-47293: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47293 affects the Linux kernel's network scheduler component, specifically the act_skbmod functionality. The vulnerability was discovered when it was found that tcf_skbmod_act() incorrectly assumes all packets use Ethernet as their L2 protocol, which is not always the case (Kernel Git).

The vulnerability exists in the net/sched/act_skbmod.c file where tcf_skbmod_act() function processes packets without properly checking their network protocol type. When used with non-Ethernet devices like CAN (Controller Area Network), the function attempts to modify packet headers assuming they are Ethernet packets, leading to packet corruption (Kernel Git).

When exploited, this vulnerability results in silent corruption of network packets on non-Ethernet devices, particularly affecting CAN devices when specific traffic control (tc) commands are executed. This can lead to data integrity issues in affected systems (Kernel Git).

The vulnerability can be triggered by configuring traffic control rules on non-Ethernet interfaces, specifically when using the skbmod action. A proof-of-concept exists using CAN devices with commands: 'ip link add dev vcan0 type vcan', 'ip link set up vcan0', 'tc qdisc add dev vcan0 root handle 1: htb', and 'tc filter add dev vcan0 parent 1: protocol ip prio 10 matchall action skbmod swap mac' (Kernel Git).

The vulnerability has been patched in the Linux kernel by adding a check to skip skbmod actions for non-Ethernet packets. The fix involves verifying the device type before performing packet modifications. Users should update their Linux kernel to a version containing the fix (Red Hat).