CVE-2021-47371

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nexthop: Fix memory leaks in nexthop notification chain listeners

syzkaller discovered memory leaks [1] that can be reduced to the

following commands:

# ip nexthop add id 1 blackhole

# devlink dev reload pci/0000:06:00.0

As part of the reload flow, mlxsw will unregister its netdevs and then

unregister from the nexthop notification chain. Before unregistering

from the notification chain, mlxsw will receive delete notifications for

nexthop objects using netdevs registered by mlxsw or their uppers. mlxsw

will not receive notifications for nexthops using netdevs that are not

dismantled as part of the reload flow. For example, the blackhole

nexthop above that internally uses the loopback netdev as its nexthop

device.

One way to fix this problem is to have listeners flush their nexthop

tables after unregistering from the notification chain. This is

error-prone as evident by this patch and also not symmetric with the

r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References