Name | CVE-2021-47560 |
Description | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum: Protect driver from buggy firmware When processing port up/down events generated by the device's firmware, the driver protects itself from events reported for non-existent local ports, but not the CPU port (local port 0), which exists, but lacks a netdev. This can result in a NULL pointer dereference when calling netif_carrier_{on,off}(). Fix this by bailing early when processing an event reported for the CPU port. Problem was only observed when running on top of a buggy emulator. |
Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
Source Package | Release | Version | Status |
---|---|---|---|
linux (PTS) | bullseye | 5.10.223-1 | fixed |
bullseye (security) | 5.10.226-1 | fixed | |
bookworm | 6.1.115-1 | fixed | |
bookworm (security) | 6.1.119-1 | fixed | |
sid, trixie | 6.11.10-1 | fixed |
The information below is based on the following data on fixed versions.
Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
---|---|---|---|---|---|---|
linux | source | buster | (not affected) | |||
linux | source | bullseye | 5.10.84-1 | |||
linux | source | (unstable) | 5.15.15-1 |
[buster] - linux <not-affected> (Vulnerable code not present)
https://git.kernel.org/linus/63b08b1f6834bbb0b4f7783bf63b80c8c8e9a047 (5.16-rc3)