CVE-2021-47293

A vulnerability was found in the Linux kernel’s act_skbmod module, where the tcf_skbmod_act() function mistakenly assumes all packets use Ethernet as their protocol. This issue can lead to the corruption of non-Ethernet packets, such as those from CAN devices, if skbmod actions are incorrectly applied. This misinterpretation results in unexpected packet manipulation and data corruption.

A flaw in the act_skbmod traffic control action caused it to modify non-Ethernet packets without validating the link-layer type, silently corrupting frames on devices such as CAN. The patch adds a guard to skip skbmod actions unless skb->dev->type == ARPHRD_ETHER. This results in a moderate (or low) severity local integrity issue requiring administrative privileges within a (network) namespace to trigger.

This vulnerability is classified as moderate severity due to its potential impact on packet integrity.

Please note that this fix was incorporated in Red Hat Enterprise Linux 8.10 at the time of its release.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.