CVE-2021-43267 Overview
CVE-2021-43267 is a remote heap overflow vulnerability in the Linux kernel's Transparent Inter-Process Communication (TIPC) module. The flaw exists in net/tipc/crypto.c and affects Linux kernel versions before 5.14.16. The TIPC protocol fails to validate user-supplied size fields in MSG_CRYPTO message types, allowing remote attackers to trigger memory corruption. Successful exploitation can lead to arbitrary code execution in kernel context without authentication or user interaction. The vulnerability impacts the upstream Linux kernel, Fedora 34/35, and several NetApp HCI storage appliances that ship the affected kernel.
Critical Impact
Unauthenticated remote attackers can achieve kernel-level code execution on systems with the TIPC module loaded, leading to full system compromise.
Affected Products
- Linux Kernel versions prior to 5.14.16
- Fedora 34 and Fedora 35
- NetApp HCI storage nodes (H300S, H500S, H700S, H300E, H500E, H700E, H410S)
Discovery Timeline
- 2021-11-02 - CVE-2021-43267 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2021-43267
Vulnerability Analysis
The vulnerability resides in the TIPC protocol implementation, a network protocol used for cluster-wide inter-process communication in the Linux kernel. TIPC introduced a new user message type called MSG_CRYPTO in kernel version 5.10 to allow peers to exchange cryptographic keys. The handler for these messages, located in tipc_crypto_key_rcv() within net/tipc/crypto.c, parses attacker-controlled length fields from incoming packets without verifying them against the actual packet size.
An attacker can craft a TIPC packet where the keylen field declares a size larger than the data present in the message body. The kernel allocates a buffer based on this declared length, but the subsequent memcpy() reads beyond the bounds of the source buffer, producing a heap overflow primitive. This corruption occurs in kernel memory and can be leveraged for privilege escalation or remote code execution.
Root Cause
The root cause is improper validation of user-supplied size parameters [CWE-1284]. The TIPC code trusts the keylen and masterkey fields from the message header without cross-checking them against the actual received packet length, violating defensive parsing principles for untrusted network input.
Attack Vector
Exploitation requires the tipc.ko kernel module to be loaded on the target system. An attacker on the same network can send a malicious TIPC packet containing a forged MSG_CRYPTO message. Because TIPC operates at layer 2 by default but can also run over UDP, exposure depends on the host configuration. No authentication, user interaction, or prior privileges are required.
The vulnerability mechanism is documented in the upstream fix commit fa40d9734a57bcbfa79a280189799f76c88f7bb0. Refer to the GitHub Linux Commit and the OpenWall Security Discussion for the technical patch analysis.
Detection Methods for CVE-2021-43267
Indicators of Compromise
- Unexpected loading of the tipc.ko kernel module on hosts that do not use cluster IPC
- Kernel panics, oops messages, or BUG: KASAN entries referencing tipc_crypto_key_rcv in dmesg or /var/log/messages
- Anomalous TIPC traffic (EtherType 0x88CA) observed on network segments where TIPC is not expected
- Unauthorized root-level processes spawned shortly after TIPC packet receipt
Detection Strategies
- Inventory kernel module load state across hosts and flag systems where tipc is loaded but not required
- Deploy network sensors to alert on TIPC frames (EtherType 0x88CA) and TIPC-over-UDP traffic on port 6118
- Correlate kernel crash telemetry with network packet captures to identify exploitation attempts
- Monitor for new kernel threads or privileged processes created from network-facing kernel paths
Monitoring Recommendations
- Forward kernel logs and EDR telemetry to a centralized data lake for retrospective hunting against the tipc_crypto_key_rcv signature
- Enable kernel address sanitizer (KASAN) or panic_on_oops=1 in test environments to surface exploit attempts
- Track patch compliance status for Linux kernel versions across the fleet and alert on hosts below 5.14.16
How to Mitigate CVE-2021-43267
Immediate Actions Required
- Upgrade the Linux kernel to version 5.14.16 or later on all affected hosts
- Apply distribution-specific updates for Fedora 34/35 and NetApp HCI firmware referenced in the vendor advisories
- Audit which hosts load the tipc module and unload it where not required for production workloads
- Restrict TIPC traffic at network boundaries using switch ACLs or host firewall rules
Patch Information
The fix is included upstream in Linux kernel 5.14.16 as documented in the Linux Kernel ChangeLog. The corrective commit fa40d9734a57bcbfa79a280189799f76c88f7bb0 adds proper bounds checking against the actual skb length before the key copy operation. Distribution updates are available via the Fedora Package Announcement and the NetApp Security Advisory.
Workarounds
- Blacklist the TIPC module on systems that do not use it by adding blacklist tipc to /etc/modprobe.d/
- Unload the running module with rmmod tipc after confirming no active dependencies
- Block TIPC EtherType 0x88CA and UDP port 6118 at network ingress points until patching is complete
# Disable the TIPC kernel module to remove the attack surface
echo "blacklist tipc" | sudo tee /etc/modprobe.d/disable-tipc.conf
echo "install tipc /bin/true" | sudo tee -a /etc/modprobe.d/disable-tipc.conf
sudo rmmod tipc 2>/dev/null || true
lsmod | grep tipc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
