CVE-2021-47238 is a medium-severity vulnerability in the Linux kernel affecting the IPv4 multicast implementation, specifically within the ip_mc_add1_src function in the net/ipv4/igmp.c source file. The vulnerability arises from a memory leak caused by improper management of multicast source lists when network interfaces are destroyed or go down. A recent kernel commit (24803f38a5c0) removed a call to ip_mc_clear_src() in the ip_mc_destroy_dev() function, assuming it was redundant because ip_mc_clear_src() was also called in igmpv3_clear_delrec(). However, ip_mc_clear_src() called in igmpv3_clear_delrec() does not release the multicast source list (in_dev->mc_list->sources). Meanwhile, the device pointer dev->ip_ptr is set to NULL via RCU_INIT_POINTER(), making the in_dev structure inaccessible through inetdev_by_index(). Consequently, the multicast source list remains unreleased and leads to a memory leak when sockets are closed and multicast sources are deleted. The leak occurs during the socket close sequence, involving functions such as sock_close, __sock_release, inet_release, ip_mc_drop_socket, and ip_mc_del1_src. This vulnerability does not directly impact confidentiality or integrity but affects availability by causing resource exhaustion through memory leaks. The CVSS 3.1 score is 5.5 (medium severity), with attack vector local, low attack complexity, requiring privileges, no user interaction, and impacting availability only. The vulnerability affects multiple Linux kernel versions prior to the fix and is relevant to systems using IPv4 multicast networking. No known exploits are reported in the wild as of the publication date.

For European organizations, the impact of CVE-2021-47238 primarily concerns systems running Linux kernels with affected versions that handle IPv4 multicast traffic. This includes servers, network appliances, and embedded devices in sectors such as telecommunications, finance, government, and critical infrastructure where Linux is prevalent. The memory leak can lead to gradual resource exhaustion, causing degraded system performance or crashes, potentially disrupting network services reliant on multicast communication (e.g., streaming, conferencing, or real-time data distribution). While the vulnerability does not allow remote code execution or data compromise, denial of service through resource depletion can affect availability of critical services. Organizations with large-scale Linux deployments or multicast-heavy environments are at higher risk. The absence of known exploits reduces immediate threat but does not eliminate risk, especially if attackers gain local access or privileges. Therefore, European entities should consider this vulnerability in their risk assessments, particularly those operating in sectors with stringent availability requirements or using multicast extensively.

To mitigate CVE-2021-47238, European organizations should: 1) Apply the official Linux kernel patches that restore the call to ip_mc_clear_src() in ip_mc_destroy_dev(), ensuring proper cleanup of multicast source lists and preventing memory leaks. 2) Regularly update Linux kernel versions to the latest stable releases that include this fix. 3) Monitor system memory usage and kernel logs for signs of resource leaks or abnormal multicast socket behavior. 4) Limit local user privileges to reduce the risk of exploitation, as the vulnerability requires local privileges. 5) For critical systems, consider implementing kernel live patching solutions to apply fixes without downtime. 6) Audit and restrict multicast usage where possible to minimize exposure. 7) Employ system resource monitoring and alerting to detect potential denial-of-service conditions early. These steps go beyond generic advice by focusing on patch management, privilege control, and operational monitoring specific to this vulnerability's characteristics.