CVE-2021-47546

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix memory leak in fib6_rule_suppress

The kernel leaks memory when a `fib` rule is present in IPv6 nftables

firewall rules and a suppress_prefix rule is present in the IPv6 routing

rules (used by certain tools such as wg-quick). In such scenarios, every

incoming packet will leak an allocation in `ip6_dst_cache` slab cache.

After some hours of `bpftrace`-ing and source code reading, I tracked

down the issue to ca7a03c41753 ("ipv6: do not free rt if

FIB_LOOKUP_NOREF is set on suppress rule").

The problem with that change is that the generic `args->flags` always have

`FIB_LOOKUP_NOREF` set[1][2] but the IPv6-specific flag

`RT6_LOOKUP_F_DST_NOREF` might not be, leading to `fib6_rule_suppress` not

decreasing the refcount when needed.

How to reproduce:

- Add the following nftables rule to a prerouting chain:

meta nfproto ipv6 fib saddr . mark . iif oif missing drop

This can be done with:

sudo nft cre

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References