CVE-2021-47137
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
In the Linux kernel, the lantiq network driver has a vulnerability leading to memory corruption in the RX ring. When memory allocation or DMA mapping fails, an invalid address is programmed into the descriptor, which can lead to memory corruption. The fix makes DMA reuse the previous skb and mapping and drop the packet, incrementing the rx drop counter.
Risk Assessment
The vulnerability could lead to kernel memory corruption, potentially resulting in system crash or privilege escalation.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix that adds error handling for allocation and DMA mapping in the lantiq driver.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corruption in RX ring In a situation where memory allocation or dma mapping fails, an invalid address is programmed into the descriptor. This can lead to memory corruption. If the memory allocation fails, DMA should reuse the previous skb and mapping and drop the packet. This patch also increments rx drop counter.