PT-2024-8988 · Linux+7 · Linux Kernel+7

Amit Cohen · Published 2023-05-09 · Updated 2025-01-06 · CVE-2021-47560

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a NULL pointer dereference in the Linux kernel's mlxsw spectrum driver. This occurs when processing port up/down events generated by the device's firmware, specifically for the CPU port (local port 0), which exists but lacks a netdev. The problem was observed when running on top of a buggy emulator. The vulnerability can result in a denial of service.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2024:7000

ALSA-2024:7001

BDU:2024-10670

CESA-2024_7000

CESA-2024_7001

CVE-2021-47560

INFSA-2024_7000

INFSA-2024_7001

OPENSUSE-SU-2024_2189-1

RHSA-2023:2148

RHSA-2023:2458

RHSA-2023_2148

RHSA-2023_2458

RHSA-2024:7000

RHSA-2024:7001

RHSA-2024:8107

RHSA-2024:8161

RHSA-2024_7000

RHSA-2024_7001

RLSA-2024:7001

SUSE-SU-2024:2008-1

SUSE-SU-2024:2011-1

SUSE-SU-2024:2019-1

SUSE-SU-2024:2189-1

SUSE-SU-2024:2190-1

Affected Products

Almalinux

Astra Linux

Centos

Linux Kernel

Red Hat

Red Os

Rocky Linux

Suse

References · 1670

• https://nvd.nist.gov/vuln/detail/CVE-2021-47560 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47560 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2190-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:7001 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2019-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2024-7000.html · Vendor Advisory
• https://git.kernel.org/stable/c/63b08b1f6834bbb0b4f7783bf63b80c8c8e9a047 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-47560 · Vendor Advisory
• https://git.kernel.org/stable/c/90d0736876c50ecde1a3275636a06b9ddb1cace9 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2189-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-47560 · Security Note
• https://errata.rockylinux.org/RLSA-2024:7001 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47560 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:7001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-47560 · Vendor Advisory