CVE-2021-47194 cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
A missing cleanup call in the Linux kernel Wi-Fi subsystem can corrupt linked lists, potentially leading to system crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47194?
CVE-2021-47194 is a high-severity memory corruption vulnerability in Linux kernel, published on 10 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
If the userspace tools switch from NL80211_IFTYPE_P2P_GO to NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it does not call the cleanup cfg80211_stop_ap(), this leads to the initialization of in-use data. For example, this path re-init the sdata->assigned_chanctx_list while it is still an element of assigned_vifs list, and makes that linked list corrupt.
Weakness: CWE-665
Which versions are affected by CVE-2021-47194?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47194?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-47194 being exploited?
There is no known exploitation of CVE-2021-47194 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47194, GHSA-p3j3-7q7c-3g53, UBUNTU-CVE-2021-47194.