CVE-2021-47137 net: lantiq: fix memory corruption in RX ring
A memory corruption vulnerability in the Linux kernel Lantiq network driver allows attackers to cause system crashes or potentially execute code via crafted network packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47137?
CVE-2021-47137 is a critical memory corruption vulnerability in Linux kernel, published on 25 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: lantiq: fix memory corruption in RX ring
In a situation where memory allocation or dma mapping fails, an invalid address is programmed into the descriptor. This can lead to memory corruption. If the memory allocation fails, DMA should reuse the previous skb and mapping and drop the packet. This patch also increments rx drop counter.
Weakness: CWE-770
Which versions are affected by CVE-2021-47137?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47137?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-47137 being exploited?
There is no known exploitation of CVE-2021-47137 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47137, GHSA-x7cq-pgcc-cqqm, UBUNTU-CVE-2021-47137.