UDP Tunnel Packet Aggregation Vulnerability in Linux Kernel
Summary
CVE-2021-47036: In the Linux kernel, the following vulnerability has been resolved: udp: skip L4 aggregation for UDP tunnel packets If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there are UDP tunnels available in the s... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of a Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It supports various networking protocols, including UDP (User Datagram Protocol), which is widely used for transmitting data over the internet. The vulnerability in question arises from the kernel's handling of UDP tunnel packets, specifically when certain features are enabled, leading to potential data corruption.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the udp_gro_receive() function, which can lead to Layer 4 (L4) aggregation of UDP tunnel packets when NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled. This aggregation can cause inner protocol corruption, particularly affecting protocols like VXLAN (Virtual Extensible LAN). As a result, packets with different VXLAN IDs may be incorrectly aggregated into a single Generic Segmentation Offload (GSO) packet, leading to data loss or miscommunication. The issue arises from the kernel's failure to skip the aggregation process for packets that are part of a UDP tunnel, which could hold TCP over VXLAN packets in the GRO engine until the next flush, causing delays and potential data integrity issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the NETIF_F_GRO_FRAGLIST and NETIF_F_GRO_UDP_FWD features if they are not required for their applications. This can be done by modifying the network interface settings or kernel parameters, but it is recommended to apply the kernel update as the primary solution.
Conclusion
The vulnerability identified as CVE-2021-47036 in the Linux kernel poses significant risks to data integrity and communication for systems utilizing UDP tunnels. It is crucial for users to update their kernel to the latest version to mitigate these risks. Temporary workarounds are available, but the recommended approach is to apply the kernel update.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to inner protocol corruption, causing data loss and miscommunication in applications relying on UDP tunnels.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
All versions prior to 5.14.6-1 are affected by this vulnerability.
Yes, updating to version 5.14.6-1 or later of the Linux kernel will permanently fix the issue.
These are features in the Linux kernel that enable Generic Receive Offload (GRO) for fragmented packets and UDP forwarding, respectively.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
