PT-2024-11395 · Linux+2 · Linux Kernel+2
Feng Zhou
·
Published
2021-09-29
·
Updated
2024-12-24
·
CVE-2021-47399
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel's ixgbe driver is vulnerable to a NULL pointer dereference in the ixgbe xdp setup function. This occurs when the maximum value of num xdp queues is set to nr cpu ids, and the user sets num queues to 63 through ethtool. The code in ixgbe set rss queues sets the queues number, and when the user uses xdp, it leads to a panic. The issue arises from the fact that num rx queues is greater than num xdp queues when running ixgbe xdp setup.
Technical details about exploitation include:
- The
ixgbe set rss queuesfunction sets the queues number. - The
ixgbe xdp setupfunction leads to a panic whennum rx queuesis greater thannum xdp queues. - The
adapter->xdp ring[i]->xsk umemvariable is accessed in a loop, leading to the NULL pointer dereference.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Suse