CVE-2021-47602: mac80211: track only QoS data frames for admission control
In the Linux kernel, the following vulnerability has been resolved:
mac80211: track only QoS data frames for admission control
For admission control, obviously all of that only works for QoS data frames, otherwise we cannot even access the QoS field in the header.
Syzbot reported (see below) an uninitialized value here due to a status of a non-QoS nullfunc packet, which isn't even long enough to contain the QoS header.
Fix this to only do anything for QoS data packets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47602?
CVE-2021-47602 has been classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2021-47602?
To fix CVE-2021-47602, upgrade to a patched version of the Linux kernel that does not contain this vulnerability.
Which versions of the Linux kernel are affected by CVE-2021-47602?
CVE-2021-47602 affects various versions of the Linux kernel between 3.19 and 5.16-rc5.
What type of vulnerability is CVE-2021-47602?
CVE-2021-47602 is a vulnerability related to admission control on QoS data frames in the mac80211 subsystem of the Linux kernel.
Has CVE-2021-47602 been resolved?
Yes, CVE-2021-47602 has been resolved in updated versions of the Linux kernel.