CVE-2021-47164

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47164
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix null deref accessing lag dev It could be the lag dev is null so stop processing the event. In bond_enslave() the active/backup slave being set before setting the upper dev so first event is without an upper dev. After setting the upper dev with bond_master_upper_dev_link() there is a second event and in that event we have an upper dev.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2e4b0b95a489259f9d35a3db17023061f8f3d587 Patch
https://git.kernel.org/stable/c/83026d83186bc48bb41ee4872f339b83f31dfc55 Patch
https://git.kernel.org/stable/c/bdfd3593a8248eea6ecfcbf7b47b56b86515672d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 May 2024, 17:50

Type Values Removed Values Added
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/2e4b0b95a489259f9d35a3db17023061f8f3d587 - () https://git.kernel.org/stable/c/2e4b0b95a489259f9d35a3db17023061f8f3d587 - Patch
References () https://git.kernel.org/stable/c/83026d83186bc48bb41ee4872f339b83f31dfc55 - () https://git.kernel.org/stable/c/83026d83186bc48bb41ee4872f339b83f31dfc55 - Patch
References () https://git.kernel.org/stable/c/bdfd3593a8248eea6ecfcbf7b47b56b86515672d - () https://git.kernel.org/stable/c/bdfd3593a8248eea6ecfcbf7b47b56b86515672d - Patch

25 Mar 2024, 13:47

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net/mlx5e: corrigió el deref nulo al acceder a lag dev. Podría ser que el lag dev sea nulo, así que deje de procesar el evento. En bond_enslave(), el esclavo activo/de respaldo se configura antes de configurar el desarrollo superior, por lo que el primer evento es sin un desarrollo superior. Después de configurar el desarrollo superior con bond_master_upper_dev_link() hay un segundo evento y en ese evento tenemos un desarrollo superior.

25 Mar 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-25 10:15

Updated : 2024-05-23 17:50

NVD link : CVE-2021-47164

Mitre link : CVE-2021-47164

CVE.ORG link : CVE-2021-47164

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference