CVE-2021-47371 is a high-severity vulnerability in the Linux kernel related to memory leaks in the nexthop notification chain listeners subsystem. The issue arises during the reload flow of certain network drivers, specifically the Mellanox Spectrum (mlxsw) driver, which unregisters its network devices (netdevs) and subsequently unregisters from the nexthop notification chain. During this process, mlxsw receives delete notifications for nexthop objects associated with its registered netdevs or their upper layers. However, it does not receive notifications for nexthops that use netdevs not dismantled during the reload, such as blackhole nexthops that internally use the loopback device. This discrepancy leads to memory leaks because some nexthop objects remain referenced without proper cleanup. The root cause is that listeners do not flush their nexthop tables after unregistering from the notification chain, which is error-prone and asymmetrical compared to the registration path where listeners receive a dump of all existing nexthops. The fix implemented involves replaying delete notifications for the listener being unregistered, making the unregister process symmetric to registration and consistent with netdev notification chains. This requires careful handling of the RTNL (rtnetlink) lock to avoid deadlocks, especially for drivers like VXLAN that previously held RTNL during unregistering. The patch changes VXLAN to unregister its nexthop listener without holding RTNL, aligning with the registration path. The vulnerability was discovered using syzkaller, a kernel fuzzer, which detected unreferenced objects indicating memory leaks. The CVSS v3.1 base score is 7.1 (high), with an attack vector of local (AV:L), low attack complexity (AC:L), requiring low privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), but high integrity (I:H) and availability (A:H) impacts. This means exploitation requires local access with some privileges but can cause significant integrity and availability issues, such as resource exhaustion or system instability due to memory leaks in critical networking components. No known exploits are reported in the wild, but the vulnerability affects Linux kernel versions containing the affected commits, particularly those using the mlxsw driver and related networking subsystems. The issue is classified under CWE-400 (Uncontrolled Resource Consumption).

For European organizations, the impact of CVE-2021-47371 can be significant, especially for those relying on Linux-based infrastructure with Mellanox Spectrum switches or similar hardware using the mlxsw driver. The memory leak can lead to resource exhaustion, causing degraded network performance, denial of service, or system crashes. This can disrupt critical services such as data centers, cloud providers, telecommunications, and enterprises with high network throughput requirements. Given the local attack vector, the threat is more relevant to environments where untrusted or semi-trusted users have local access, such as multi-tenant cloud platforms, shared hosting, or internal networks with insufficient access controls. The high integrity and availability impact means attackers could potentially disrupt routing or network forwarding, affecting business continuity and service availability. European organizations in sectors like finance, healthcare, government, and critical infrastructure that depend on stable and secure Linux networking stacks may face operational risks. Additionally, the complexity of the fix and the need for kernel updates may delay patch deployment, prolonging exposure. However, the lack of known exploits in the wild reduces immediate risk but does not eliminate the need for proactive mitigation.

1. Apply Kernel Updates: Organizations should promptly apply Linux kernel patches that address CVE-2021-47371. This involves updating to kernel versions that include the fix for the nexthop notification chain memory leak. 2. Audit Network Drivers: Review the use of mlxsw and related network drivers in the environment. If Mellanox Spectrum hardware or similar devices are in use, prioritize patching those systems. 3. Restrict Local Access: Limit local access to systems running vulnerable kernels. Enforce strict access controls, use multi-factor authentication, and monitor for unauthorized local logins. 4. Monitor Resource Usage: Implement monitoring for unusual memory consumption or network subsystem anomalies that could indicate exploitation attempts or memory leaks. 5. Test Patches in Staging: Due to the complexity of the fix involving RTNL locking and driver behavior, thoroughly test kernel updates in staging environments to avoid regressions or deadlocks. 6. Network Segmentation: Segment critical network infrastructure to reduce the risk of lateral movement by attackers who gain local access. 7. Vendor Coordination: Engage with hardware and Linux distribution vendors to ensure timely receipt of patches and advisories related to this vulnerability. 8. Incident Response Preparedness: Prepare for potential denial-of-service scenarios by having incident response plans that include kernel-level troubleshooting and rollback procedures.