CVE-2021-47496

A flaw was found in the Linux kernel's net/tls (Kernel Transport Layer Security) subsystem. A local attacker could exploit this flaw to cause memory corruption and a Denial of Service (DoS) by crashing the system. The issue occurs due to inconsistent error sign handling in socket error reporting, where negative error codes are inadvertently interpreted as positive values. This causes the kernel to treat error conditions as successful byte transfers, resulting in buffer length underflows and corrupted memory references during data movement operations.

This vulnerability is rated with a Low severity because exploiting it requires local privileges to configure Kernel TLS (kTLS) sockets and trigger specific asynchronous error conditions during socket splice operations. In standard Red Hat Enterprise Linux installations, kTLS is not enabled or utilized by default for network traffic, as user-space cryptographic libraries handle TLS operations instead. Consequently, exposure is restricted to specialized environments that explicitly configure in-kernel TLS handling, preventing broad impact on default deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.