CVE-2021-47592

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix tc flower deletion for VLAN priority Rx steering

To replicate the issue:-

1) Add 1 flower filter for VLAN Priority based frame steering:-

$ IFDEVNAME=eth0

$ tc qdisc add dev $IFDEVNAME ingress

$ tc qdisc add dev $IFDEVNAME root mqprio num_tc 8 \

map 0 1 2 3 4 5 6 7 0 0 0 0 0 0 0 0 \

queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0

$ tc filter add dev $IFDEVNAME parent ffff: protocol 802.1Q \

flower vlan_prio 0 hw_tc 0

2) Get the 'pref' id

$ tc filter show dev $IFDEVNAME ingress

3) Delete a specific tc flower record (say pref 49151)

$ tc filter del dev $IFDEVNAME parent ffff: pref 49151

From dmesg, we will observe kernel NULL pointer ooops

[ 197.170464] BUG: kernel NULL pointer dereference, address: 0000000000000000

[ 197.171367] #PF: supervisor read access in kernel mode

[ 197.171367] #PF: error_code(0x0000) - not-present page

[ 197.171367] PGD 0 P4D 0

[ 197.171367] Oops: 0000 [#1] PREE

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References