CVE-2021-47560

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47560
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum: Protect driver from buggy firmware When processing port up/down events generated by the device's firmware, the driver protects itself from events reported for non-existent local ports, but not the CPU port (local port 0), which exists, but lacks a netdev. This can result in a NULL pointer dereference when calling netif_carrier_{on,off}(). Fix this by bailing early when processing an event reported for the CPU port. Problem was only observed when running on top of a buggy emulator.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/63b08b1f6834bbb0b4f7783bf63b80c8c8e9a047 Patch
https://git.kernel.org/stable/c/90d0736876c50ecde1a3275636a06b9ddb1cace9 Patch
https://git.kernel.org/stable/c/da4d70199e5d82da664a80077508d6c18f5e76df Patch
https://git.kernel.org/stable/c/63b08b1f6834bbb0b4f7783bf63b80c8c8e9a047 Patch
https://git.kernel.org/stable/c/90d0736876c50ecde1a3275636a06b9ddb1cace9 Patch
https://git.kernel.org/stable/c/da4d70199e5d82da664a80077508d6c18f5e76df Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*
History

06 Jan 2025, 20:47

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
References () https://git.kernel.org/stable/c/63b08b1f6834bbb0b4f7783bf63b80c8c8e9a047 - () https://git.kernel.org/stable/c/63b08b1f6834bbb0b4f7783bf63b80c8c8e9a047 - Patch
References () https://git.kernel.org/stable/c/90d0736876c50ecde1a3275636a06b9ddb1cace9 - () https://git.kernel.org/stable/c/90d0736876c50ecde1a3275636a06b9ddb1cace9 - Patch
References () https://git.kernel.org/stable/c/da4d70199e5d82da664a80077508d6c18f5e76df - () https://git.kernel.org/stable/c/da4d70199e5d82da664a80077508d6c18f5e76df - Patch

21 Nov 2024, 06:36

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/63b08b1f6834bbb0b4f7783bf63b80c8c8e9a047 - () https://git.kernel.org/stable/c/63b08b1f6834bbb0b4f7783bf63b80c8c8e9a047 -
References () https://git.kernel.org/stable/c/90d0736876c50ecde1a3275636a06b9ddb1cace9 - () https://git.kernel.org/stable/c/90d0736876c50ecde1a3275636a06b9ddb1cace9 -
References () https://git.kernel.org/stable/c/da4d70199e5d82da664a80077508d6c18f5e76df - () https://git.kernel.org/stable/c/da4d70199e5d82da664a80077508d6c18f5e76df -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mlxsw: espectro: protege el controlador de firmware defectuoso Al procesar eventos de activación/desactivación de puerto generados por el firmware del dispositivo, el controlador se protege de eventos informados para puertos locales inexistentes, pero no el puerto de la CPU (puerto local 0), que existe, pero carece de netdev. Esto puede resultar en una desreferencia del puntero NULL al llamar a netif_carrier_{on,off}(). Solucione este problema cancelando el proceso con antelación al procesar un evento informado para el puerto de la CPU. El problema solo se observó cuando se ejecutaba sobre un emulador con errores.

24 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-24 15:15

Updated : 2025-01-06 20:47

NVD link : CVE-2021-47560

Mitre link : CVE-2021-47560

CVE.ORG link : CVE-2021-47560

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference