NetSight
IP …
critical9.8

CVE-2021-47013

In the Linux kernel, the following vulnerability has been resolved: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send In emac_mac_tx_buf_send, it…

Impact

In the Linux kernel, the following vulnerability has been resolved: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len). As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible free and use 'len' instead of skb->len later.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.9 before 4.9.269
from 4.10 before 4.14.233
from 4.15 before 4.19.191
from 4.20 before 5.4.119
from 5.5 before 5.10.37
from 5.11 before 5.11.21

Weakness classification

CWE-416

References