PT-2024-11189 · Linux+1 · Linux Kernel+1
Published
2021-05-18
·
Updated
2024-08-19
·
CVE-2021-47139
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.11.0-rc3+
Description
The vulnerability is related to the hns3 network driver in the Linux kernel. The issue arises when the netdevice is registered before the client initialization is complete, creating a time window between the device being available and usable. If a user attempts to change the channel number or ring parameter during this time, it may cause the
hns3 set rx cpu rmap() function to be called twice, resulting in a bug report. The vulnerability can be exploited by calling register netdev() at the end of the hns3 client init() function.Recommendations
To resolve the issue, call
register netdev() at the end of the hns3 client init() function. This ensures that the netdevice is registered only after the client initialization is complete, preventing the time window that allows the vulnerability to be exploited.Fix
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Suse