CVE-2021-47299

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xdp, net: Fix use-after-free in bpf_xdp_link_release

The problem occurs between dev_get_by_index() and dev_xdp_attach_link().

At this point, dev_xdp_uninstall() is called. Then xdp link will not be

detached automatically when dev is released. But link->dev already

points to dev, when xdp link is released, dev will still be accessed,

but dev has been released.

dev_get_by_index() |

link->dev = dev |

| rtnl_lock()

| unregister_netdevice_many()

| dev_xdp_uninstall()

| rtnl_unlock()

rtnl_lock(); |

dev_xdp_attach_link() |

rtnl_unlock(); |

| netdev_run_todo() // dev released

bpf_xdp_link_release() |

/* access dev. |

use-after-free */ |

[ 45.966867] BUG: KASAN: use-after-free in bpf_xdp_link_release

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References