CVE-2021-47591: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47591 affects the Linux kernel's MPTCP (Multipath TCP) implementation. The vulnerability was discovered when TCP_ULP setsockopt was found to be incompatible with MPTCP because it's already used internally to plumb subflow (tcp) sockets to the MPTCP layer. This issue was first disclosed on June 19, 2024, and affects Linux kernel versions from 5.13 up to (excluding) 5.15.11, as well as 5.16-rc1 through 5.16-rc5 (NVD).

The vulnerability is caused by a null pointer dereference that occurs when TCP_ULP setsockopt is used with MPTCP connections in fallback mode. The issue manifests in the tls_build_proto function, triggered through the call chain involving tcp_set_ulp and mptcp_setsockopt. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a kernel crash due to a null pointer dereference, leading to a denial of service condition. The impact is limited to availability with no direct effects on confidentiality or integrity of the system (NVD).

The vulnerability requires local access to the system and can be triggered through the TCP_ULP setsockopt system call when used with MPTCP connections. The exploit has been demonstrated in laboratory conditions using the syzkaller kernel fuzzer (Kernel Patch).

The vulnerability has been fixed by removing support for TCP_ULP setsockopt in MPTCP. The fix was implemented through kernel patches that remove the TCP_ULP option from the list of supported socket options in the MPTCP implementation (Kernel Patch).