Security readout for executives and security teams
Plain-English summary
This is a Linux kernel information leak. An unprivileged local user could cause kernel memory bytes to be copied back through UDP socket diagnostics. The source bundle does not show active exploitation or remote reachability, but kernel memory disclosure can weaken defense-in-depth and support further attacks.
Executive priority
Treat this as a moderate-priority kernel patching item. It is not shown as remotely exploitable or actively exploited, but unprivileged local kernel information leaks matter on shared systems and can assist broader compromise chains.
Technical view
UDP handling did not initialize r->idiag_expires before inet_sk_diag_fill() returned socket diagnostic data. KMSAN observed uninitialized bytes copied to user space through netlink diagnostic output. The fix initializes the field in inet_sk_diag_fill() so UDP and future callers do not leak uninitialized kernel data.
Likely exposure
Linux systems running affected kernel versions are relevant, especially multi-user systems or hosts where untrusted local users can execute code. The bundle lists Linux as affected from 3.3 through fixed stable lines including 5.4.168, 5.10.88, 5.15.11, and 5.16.
Exploitation context
The kernel description says the issue can be exploited by unprivileged users. The bundle marks KEV as false and provides no evidence of active exploitation in the wild. The report appears to come from KMSAN and syzkaller-style testing, not a public weaponized exploit.
Researcher notes
Focus analysis on inet_diag UDP diagnostic output and initialization of idiag_expires in inet_sk_diag_fill(). The source does not provide CVSS, CWE, exploit maturity, or distribution-specific package status, so validation should rely on kernel commit presence or vendor backport confirmation.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Check distribution advisories for backported CVE-2021-47597 patches.
- Prioritize systems allowing untrusted local user or workload execution.
- Reduce unnecessary local user access while patching is pending.
- Avoid custom kernels missing the inet_diag fix.
Validation and detection
- Inventory running Linux kernel versions across affected fleets.
- Compare installed kernels against vendor fixed builds or referenced commits.
- Review package changelogs for CVE-2021-47597 or inet_diag fixes.
- Confirm unsupported or custom kernels include the stable patch.
- Track remediation separately for externally managed appliances.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47597 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7b5596e531253ce84213d9daa7120b71c9d83198CVE reference, Linux
- https://git.kernel.org/stable/c/3a4f6dba1eb98101abc012ef968a8b10dac1ce50CVE reference, Linux
- https://git.kernel.org/stable/c/e5d28205bf1de7082d904ed277ceb2db2879e302CVE reference, Linux
- https://git.kernel.org/stable/c/71ddeac8cd1d217744a0e060ff520e147c9328d1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.