CVE-2021-47586

published 2024-06-19

CVE-2021-47586: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup KASAN reports an out-of-bounds read in…

Priority P4 19 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup

KASAN reports an out-of-bounds read in rk_gmac_setup on the line:

while (ops->regs[i]) {

This happens for most platforms since the regs flexible array member is
empty, so the memory after the ops structure is being read here. It
seems that mostly this happens to contain zero anyway, so we get lucky
and everything still works.

To avoid adding redundant data to nearly all the ops structures, add a
new flag to indicate whether the regs field is valid and avoid this loop
when it is not.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.15.15-1 (bookworm)	linux 5.15.15-1 (bookworm)
linux	linux	—	—
linux	linux	>= 3bb3d6b1c1957e88bfc5e77a4557f7e6ba761fe3 < 0b4a5d1e15ce72f69be48f38dc0401dab890ae0f	0b4a5d1e15ce72f69be48f38dc0401dab890ae0f
linux	linux	>= 3bb3d6b1c1957e88bfc5e77a4557f7e6ba761fe3 < 0546b224cc7717cc8a2db076b0bb069a9c430794	0546b224cc7717cc8a2db076b0bb069a9c430794
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.15.15-1	5.15.15-1
linux	linux_kernel	>= 0 < 5.15.15-1	5.15.15-1
linux	linux_kernel	>= 0 < 5.15.15-1	5.15.15-1
linux	linux_kernel	>= 5.14 < 5.15.11	5.15.11

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-125