CVE-2021-47451

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value

Currently, when the rule related to IDLETIMER is added, idletimer_tg timer

structure is initialized by kmalloc on executing idletimer_tg_create

function. However, in this process timer->timer_type is not defined to

a specific value. Thus, timer->timer_type has garbage value and it occurs

kernel panic. So, this commit fixes the panic by initializing

timer->timer_type using kzalloc instead of kmalloc.

Test commands:

# iptables -A OUTPUT -j IDLETIMER --timeout 1 --label test

$ cat /sys/class/xt_idletimer/timers/test

Killed

Splat looks like:

BUG: KASAN: user-memory-access in alarm_expires_remaining+0x49/0x70

Read of size 8 at addr 0000002e8c7bc4c8 by task cat/917

CPU: 12 PID: 917 Comm: cat Not tainted 5.14.0+ #3 79940a339f71eb14fc81aee1757a20d5bf13eb0e

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References