Loading vulnerability…
Linux kernel TCP congestion-control double initialization resource leak
CVE-2021-47304 is a resource-leak flaw in the Linux kernel TCP subsystem. During connection establishment, tcp_init_transfer() could clear the icsk_ca_initialized state even when congestion control had already been initialized. This permits tcp_init_congestion_control() to invoke a congestion-control module's init callback a second time without an intervening release callback. Congestion-control implementations that allocate state during initialization, including CDG, can leak that state; other module-specific effects are possible.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A local low-privileged process can repeatedly trigger memory leaks in affected congestion-control modules. Sustained exploitation can consume kernel memory and cause availability degradation or denial of service. No confidentiality or integrity impact is stated.
If you can’t patch tonight, do this now.
Until patched, restrict untrusted local users from executing workloads that can create TCP Fast Open connections and alter per-socket congestion-control settings during connection establishment. Monitor for abnormal kernel-memory growth and apply resource limits to untrusted workloads. Disabling or limiting TCP Fast Open may reduce exposure where operationally acceptable, but upgrading is the definitive mitigation.
Patch, then assume compromise.
Upgrade to a Linux kernel release containing the upstream fix. The issue is fixed in Linux kernel versions 5.10.53, 5.13.5, and 5.14, and later stable releases. Use vendor kernel updates where applicable; Red Hat Enterprise Linux 8 fixes are available through RHSA-2024:5101 and RHSA-2024:5102.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.