Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-47517
HistoryMay 24, 2024 - 12:00 a.m.

CVE-2021-47517

2024-05-2400:00:00
ubuntu.com
ubuntu.com
7
linux kernel
ethtool
vulnerability
net devices
unregistration
patch
netlink
ioctl
rtnl lock
tx queues
null pointer exceptions
use-after-free

AI Score

6.6

Confidence

Low

EPSS

0

Percentile

15.5%

In the Linux kernel, the following vulnerability has been resolved:
ethtool: do not perform operations on net devices being unregistered There
is a short period between a net device starts to be unregistered and when
it is actually gone. In that time frame ethtool operations could still be
performed, which might end up in unwanted or undefined behaviours[1]. Do
not allow ethtool operations after a net device starts its unregistration.
This patch targets the netlink part as the ioctl one isn’t affected: the
reference to the net device is taken and the operation is executed within
an rtnl lock section and the net device won’t be found after unregister.
[1] For example adding Tx queues after unregister ends up in NULL pointer
exceptions and UaFs, such as: BUG: KASAN: use-after-free in
kobject_get+0x14/0x90 Read of size 1 at addr ffff88801961248c by task
ethtool/755 CPU: 0 PID: 755 Comm: ethtool Not tainted 5.15.0-rc6+ #778
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34
04/014 Call Trace: dump_stack_lvl+0x57/0x72
print_address_description.constprop.0+0x1f/0x140
kasan_report.cold+0x7f/0x11b kobject_get+0x14/0x90
kobject_add_internal+0x3d1/0x450 kobject_init_and_add+0xba/0xf0
netdev_queue_update_kobjects+0xcf/0x200
netif_set_real_num_tx_queues+0xb4/0x310 veth_set_channels+0x1c3/0x550
ethnl_set_channels+0x524/0x610

AI Score

6.6

Confidence

Low

EPSS

0

Percentile

15.5%