CVE-2021-47304 is a vulnerability in the Linux kernel's TCP congestion control initialization logic. The issue arises from a bug in the tcp_init_transfer() function, which resets the icsk_ca_initialized flag improperly during TCP connection establishment. Specifically, when a TCP socket is created and a TCP Fast Open (TFO) connect is initiated via sendto(), if a setsockopt() call to change the TCP congestion control algorithm (TCP_CONGESTION) occurs while the socket is in the TCP_SYN_SENT state, the kernel calls tcp_init_congestion_control() twice without releasing the previously allocated congestion control module resources. This double initialization can cause memory leaks or other undefined behavior in congestion control modules that allocate memory during their init functions, such as the CDG module. The root cause is that tcp_init_transfer() resets the icsk_ca_initialized flag to zero without first calling the release method of the congestion control module, leading to resource leaks. The bug was introduced by a previous commit that aimed to avoid reinitializing congestion control if already initialized but missed this particular sequence involving TFO and setsockopt calls during connection establishment. The vulnerability was discovered by the syzkaller fuzzing tool, which also produced a reproducer triggering the memory leak in the CDG congestion control module. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The vulnerability affects Linux kernel versions containing the faulty commit 8919a9b31eb4fb4c0a93e5fb350a626924302aa6. This flaw impacts the kernel's TCP stack, a critical component for network communication, and could lead to resource exhaustion or instability in affected systems under specific conditions.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions with TCP congestion control modules that allocate memory during initialization, such as CDG. The impact includes potential memory leaks that could degrade system performance or cause instability in network communication services. This is particularly concerning for servers and network infrastructure devices handling high volumes of TCP connections or using TCP Fast Open, such as web servers, application servers, and network appliances. While no direct remote code execution or privilege escalation is indicated, the memory leak could be exploited in a denial-of-service (DoS) scenario by triggering repeated connection attempts with setsockopt calls, leading to resource exhaustion. Organizations relying heavily on Linux-based infrastructure for critical services may experience degraded availability or require increased maintenance to mitigate system instability. The lack of known exploits reduces immediate risk, but the vulnerability's presence in the kernel TCP stack means that attackers with network access could attempt to exploit it. European entities in sectors such as finance, telecommunications, and government, which often use Linux servers and network devices, should be particularly vigilant. Additionally, the use of TCP Fast Open in modern applications increases the attack surface. The vulnerability does not appear to compromise confidentiality or integrity directly but can impact availability and reliability of network services.

To mitigate this vulnerability, European organizations should prioritize updating their Linux kernels to versions where this bug is fixed. Applying the latest stable kernel patches from trusted Linux distributions is the most effective measure. For environments where immediate patching is not feasible, organizations should consider disabling TCP Fast Open if it is not required, as this feature is involved in the vulnerability trigger sequence. Additionally, restricting or monitoring the use of setsockopt calls to change TCP congestion control algorithms during connection establishment could reduce exploitation risk. Network administrators should implement monitoring for unusual TCP connection patterns or repeated setsockopt invocations that could indicate attempts to trigger the bug. For critical systems, consider isolating vulnerable hosts behind firewalls or network segmentation to limit exposure. Regularly audit and update congestion control modules, especially those like CDG that allocate memory during initialization. Finally, maintain robust system resource monitoring to detect early signs of memory leaks or resource exhaustion, enabling proactive incident response.