CVE-2021-47013
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
In the Linux kernel, a use-after-free vulnerability in the emac_mac_tx_buf_send function of the EMAC network driver has been fixed. The issue is that after the skb is freed in case of an error in emac_tx_fill_tpd(), the skb is still used via skb->len by netdev_sent_queue(), leading to a use-after-free.
Risk Assessment
The vulnerability could lead to system crashes or potentially arbitrary code execution by an attacker who can send network packets through the EMAC interface. This requires network access.
Recommendation
Update the Linux kernel to a version with the fix. Also monitor network traffic on EMAC interfaces.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len). As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible free and use 'len' instead of skb->len later.