CVE-2021-47235: net: ethernet: fix potential use-after-free in ec_bhf_remove
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: fix potential use-after-free in ecbhfremove
static void ecbhfremove(struct pcidev dev) { ... struct ecbhfpriv priv = netdevpriv(netdev);
unregisternetdev(netdev); freenetdev(netdev);
pciiounmap(dev, priv->dmaio); pciiounmap(dev, priv->io); ... }
priv is netdev private data, but it is used after freenetdev(). It can cause use-after-free when accessing priv pointer. So, fix it by moving freenetdev() after pciiounmap() calls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47235?
The severity of CVE-2021-47235 is categorized as important due to potential security implications.
How do I fix CVE-2021-47235?
To fix CVE-2021-47235, ensure you update your Linux kernel to a version beyond the vulnerable ranges specified in the CVE report.
Which versions of the Linux kernel are affected by CVE-2021-47235?
CVE-2021-47235 affects Linux kernel versions from 3.15 to 5.13-rc6, including various versions in between.
What types of systems are impacted by CVE-2021-47235?
Any system running an affected version of the Linux kernel, including servers and workstations, may be impacted by CVE-2021-47235.
Is CVE-2021-47235 a local or remote vulnerability?
CVE-2021-47235 is considered a local vulnerability that could be exploited by an authenticated user to gain elevated privileges.