How To Fix CVE-2021-43267- A Heap Overflow Vulnerability In Linux Kernel's TIPC Module

Security researchers from SentinelLabs has discovered a new heap overflow vulnerability in the Linux Kernel’s Transparent Inter Process Communication (TIPC) module. The vulnerability being tracked as CVE-2021-43267 can be exploited either locally or remotely within the network to execute arbitrary code within the kernel and compromise the entire machine. Let’s know more about the Transparent Inter Process Communication (TIPC) module in Linux and see how to fix CVE-2021-43267, A heap overflow vulnerability in Linux Kernel’s TIPC Module.

What Is Transparent Inter-process Communication?

In short, TIPC, is an Inter-process communication (IPC) service in Linux which operates between nodes across the cluster. If you want to learn in detail about the TIPC, you can visit its official TIPC page.

TIPM protocol is part of all major Linux distribution kernel modules. When a user loads TIPC module, kernel uses the TIPC as a socket and configure on a network interface to work in a low privileged mode on top of ethernet protocol. Host communicate with each other by exchanging the TIPC messages between their kernels. 

The TIPC protocol operates in a way transparent to the user. Each TIPC packet is composed of a header and a payload. Each header will have two variables: Header Size and Message Size. Header Size denotes the size of the header, whereas Message Size denotes the total size of the packet.

TIPC protocol has a function ‘tipc_msg_validate‘ to validate the Header and Message Size. This function performs three validations: 1. Message Size is greater than Header Size, 2. The TIPC packet payload size is validated against the maximum user message size, and 3. The Message Size is validated against the actual received packet length.

Overview of CVE-2021-43267- A Heap Overflow Vulnerability

The vulnerability begins with the introduction of a new user message, ‘MSG_CRYPTO,’ which allows peers to send cryptographic keys. When the MSG_CRYPTO message is received, the TIPC kernel module should copy this information (the name of the key algorithm along with the key) into the storage for that node. 

The most important part of this vulnerability is lice in the Header Size calculation. As mentioned above, both Header Size and Message Size are validated against the actual packet size. Total Message Size should not exceed the range of the actual packet. The problem is, there are no checks implemented to calculate the size of the MSG_CRYPTO message against the total Message Size. This improper validation allows an attacker to create a packet with small body size to allocate heap memory. For instance, an attacker can create a 20 byte packet and set the message size to 10 bytes without failing the check. Please check the detailed technical analysis from the original report published by sentinal Labs. 

This heap overflow vulnerability can be exploited either locally or remotely within the network to execute arbitrary code within the kernel and compromise the entire machine.

Summary Of CVE-2021-43267- A Heap Overflow Vulnerability

Description: The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.

Security-Database Scoring CVSS v3

Kernel Versions Affected with the Heap Overflow Vulnerability (CVE-2021-43267)

Since this Heap Overflow Vulnerability (CVE-2021-43267) affects only to TIPC users, so they should ensure that their Linux kernel version is not between 5.10-rc1 and 5.14.16. Ubuntu published an advisory on Nov 02, 2021; look at the advisory from here.

Vulnerable Kernel Versions:

between 5.10-rc1 and 5.14.16

Patched Kernel Version:

5.15

Not Affected Versions:

5.4.0-9.12
4.13.0-16.19
4.4.0-2.16
3.11.0-12.19

How To Fix CVE-2021-43267- A Heap Overflow Vulnerability In Linux Kernel’s TIPC Module?

This vulnerability has been patched in kernel v5.15 with two changes: 1. A validation function has been moved before the copy process takes place instead of after it, 2. A size overflow check has been added along with additional checks for the minimum packet size and the supplied key size. It is recommended to upgrade your kernel to v5.15 as soon as possible.

How To Upgrade Kernel On Your Linux?

There are multiple ways to update the kernel on Linux. The best and the native way is to download and install the tested kernel package. Please contact your support to choose the best way that works for you. Just for the demonstration, we are going to show you how to upgrade the kernel on Ubuntu or Debian servers in a native way.

How To Fix CVE-2021-43267 On RedHat And CentOS?

RedHat didn’t release patches to this vulnerability as the latest version of kernel module RedHat supports is 4.18.0-305, which comes in not affected version category.

Kernel Version Supported in Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 7

Check the latest kernel versions for older RHEL here.

We hope this post will help you in knowing How to Fix CVE-2021-43267- A Heap Overflow Vulnerability in Linux Kernel’s TIPC Module. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.

• Introduction to Ubuntu
• WildPressure APT Malware campaign Targets Windows and macOS
• Step-by-Step Procedure to Install Red Hat Enterprise Linux on VMWare Workstation
• Fix Critical Vulnerabilities Found in Pentaho Business Analytics Software
• Signs of a keylogger infection on computer and smartphone