CVE-2021-47589

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

igbvf: fix double free in `igbvf_probe`

In `igbvf_probe`, if register_netdev() fails, the program will go to

label err_hw_init, and then to label err_ioremap. In free_netdev() which

is just below label err_ioremap, there is `list_for_each_entry_safe` and

`netif_napi_del` which aims to delete all entries in `dev->napi_list`.

The program has added an entry `adapter->rx_ring->napi` which is added by

`netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has

been freed below label err_hw_init. So this a UAF.

In terms of how to patch the problem, we can refer to igbvf_remove() and

delete the entry before `adapter->rx_ring`.

The KASAN logs are as follows:

[ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450

[ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366

[ 35.128360]

[ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14

[ 35.129789] Hardwar

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References