PT-2021-5501 · Linux+9 · Linux Kernel+9
Brendan Dolan-Gavitt
·
Published
2021-11-13
·
Updated
2023-11-14
·
CVE-2021-43975
CVSS v2.0
6.8
Medium
| Vector | AV:L/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 5.15.2
Description
The issue is related to the function
hw atl utils fw rpc wait in the Linux kernel, which allows an attacker to trigger an out-of-bounds write via a crafted length value. This can be exploited by introducing a crafted device, potentially leading to arbitrary code execution.Recommendations
For Linux kernel versions through 5.15.2, consider updating to a version newer than 5.15.2 to resolve the issue.
As a temporary workaround, consider restricting access to the
hw atl utils fw rpc wait function in the drivers/net/ethernet/aquantia/atlantic/hw atl/hw atl utils.c file until a patch is available.Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu