CVE-2021-47597 is a vulnerability in the Linux kernel related to an information leak in the inet_diag subsystem for UDP sockets. The issue arises because the UDP socket diagnostic code did not properly initialize the idiag_expires field in the kernel data structure used to report socket information to user space. This uninitialized memory can be copied to user space during diagnostic queries, leading to a kernel information leak. The vulnerability was detected by Kernel Memory Sanitizer (KMSAN), which flagged uninitialized memory usage in functions involved in copying kernel data to user space, specifically in netlink socket diagnostic operations. The root cause is that UDP socket diagnostic code failed to initialize certain fields, allowing residual kernel memory contents to be exposed. This flaw can be exploited by unprivileged users to read kernel memory contents, potentially revealing sensitive information such as kernel pointers or other data that could aid in further exploitation or bypass of kernel security mechanisms. The vulnerability affects Linux kernel versions prior to the fix and is present in the inet_diag and netlink diagnostic code paths. The vulnerability does not require elevated privileges beyond unprivileged user access and does not require user interaction beyond issuing diagnostic queries. Although no known exploits are reported in the wild, the flaw represents a subtle but impactful kernel information leak. The vulnerability was fixed by ensuring proper initialization of the idiag_expires field in inet_sk_diag_fill() and related diagnostic functions to prevent leaking uninitialized kernel memory to user space. This vulnerability highlights the importance of careful memory initialization in kernel diagnostic code to prevent information disclosure. The affected Linux kernel versions include those prior to the patch commit identified by the given hashes, and the issue was publicly disclosed in June 2024.

For European organizations, this vulnerability poses a risk primarily in environments running vulnerable Linux kernel versions, especially on servers, cloud infrastructure, and embedded devices using UDP sockets and diagnostic tools. The information leak could allow unprivileged local users or attackers with limited access to glean sensitive kernel memory contents, potentially facilitating privilege escalation or bypassing kernel security features such as KASLR (Kernel Address Space Layout Randomization). This could lead to further compromise of critical systems, data breaches, or disruption of services. Organizations relying on Linux-based infrastructure for critical services, including telecommunications, finance, government, and cloud providers, may be at risk if they have not applied patches. The vulnerability could also be leveraged in multi-tenant cloud environments where unprivileged users share kernel resources, increasing the risk of cross-tenant information leakage. Although the vulnerability does not directly allow remote code execution or denial of service, the information disclosure can be a stepping stone for more severe attacks. Therefore, the impact on confidentiality is moderate to high, while integrity and availability impacts are indirect but possible if combined with other exploits.

European organizations should take the following specific mitigation steps: 1) Identify all Linux systems running kernel versions prior to the fix for CVE-2021-47597, focusing on servers, cloud instances, and embedded devices using UDP sockets. 2) Apply the official Linux kernel patches that initialize the idiag_expires field properly, or upgrade to a kernel version that includes the fix. 3) For environments where immediate patching is not feasible, restrict unprivileged user access to diagnostic interfaces such as netlink sockets and inet_diag tools to limit exposure. 4) Monitor kernel logs and audit diagnostic socket usage to detect unusual or unauthorized queries that might indicate exploitation attempts. 5) Employ kernel hardening techniques such as Kernel Page Table Isolation (KPTI) and enable Kernel Memory Sanitizer (KMSAN) in development or testing environments to detect similar issues proactively. 6) Coordinate with cloud providers to ensure underlying infrastructure is patched and secure. 7) Educate system administrators about the risks of kernel information leaks and the importance of timely patching. These targeted actions go beyond generic advice by focusing on UDP socket diagnostic interfaces and unprivileged user access controls.