CVE-2021-47159 net: dsa: fix a crash if ->get_sset_count() fails
A local attacker can cause a system crash in the Linux kernel DSA subsystem by triggering a negative error code that leads to memory corruption via an integer overflow.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47159?
CVE-2021-47159 is a high-severity vulnerability in Linux kernel, published on 25 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: fix a crash if ->get_sset_count() fails
If ds->ops->get_sset_count() fails then it "count" is a negative error code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative error code is type promoted to a very high value and the loop will corrupt memory until the system crashes.
Fix this by checking for error codes and changing the type of "i" to just int.
Weakness: CWE-835
Which versions are affected by CVE-2021-47159?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47159?
Apply the vendor's patch.
Is CVE-2021-47159 being exploited?
There is no known exploitation of CVE-2021-47159 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47159, GHSA-5c7w-v73j-6cr4, UBUNTU-CVE-2021-47159.