CVE-2021-47048: spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op
In the Linux kernel, the following vulnerability has been resolved:
spi: spi-zynqmp-gqspi: fix use-after-free in zynqmpqspiexecop
When handling op->addr, it is using the buffer "tmpbuf" which has been freed. This will trigger a use-after-free KASAN warning. Let's use temporary variables to store op->addr.val and op->cmd.opcode to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If you can’t immediately patch, monitor for and triage KASAN use-after-free warnings triggered by the spi-zynqmp-gqspi issue while handling op->addr using the freed buffer tmpbuf; treat these warnings as indicators of exploitation attempts until patched.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47048?
CVE-2021-47048 has a severity rating that indicates a potential for significant impact due to a use-after-free vulnerability.
How do I fix CVE-2021-47048?
To fix CVE-2021-47048, upgrade your Linux kernel to a version later than 5.10.37, 5.11.21, or 5.12.4.
Which versions of the Linux kernel are affected by CVE-2021-47048?
CVE-2021-47048 affects Linux kernel versions between 5.10 and 5.10.37, 5.11 and 5.11.21, and 5.12 and 5.12.4.
What type of vulnerability is CVE-2021-47048?
CVE-2021-47048 is classified as a use-after-free vulnerability in the Linux kernel.
Is CVE-2021-47048 exploitable remotely?
There is potential for exploitation if the vulnerability is triggered in a specific environment, but it primarily affects local operations.