CVE-2021-28660

Q: What is the severity of CVE-2021-28660?

CVE-2021-28660 has a CVSS score of 8.8 (HIGH). This is a buffer overflow vulnerability in the rtl8188eu Wi-Fi driver staging code in Linux kernels up to 5.11.6. It allows writing beyond the end of the ssid[] array during scan operations, potentially leading to kernel memory corruption. Systems using the rtl8188eu driver in staging are affected, though this driver is considered unfinished work by kernel.org.

8.8 HIGH

Denial of Service Buffer Overflow

📋 TL;DR

This is a buffer overflow vulnerability in the rtl8188eu Wi-Fi driver staging code in Linux kernels up to 5.11.6. It allows writing beyond the end of the ssid[] array during scan operations, potentially leading to kernel memory corruption. Systems using the rtl8188eu driver in staging are affected, though this driver is considered unfinished work by kernel.org.

💻 Affected Systems

Products:

Linux kernel with rtl8188eu staging driver

Versions: Linux kernel versions through 5.11.6

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if the rtl8188eu driver is loaded (staging drivers are often not enabled by default). Embedded/IoT devices using this driver are particularly at risk.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Solidfire Baseboard Management Controller Firmware by Netapp

View all CVEs affecting Solidfire Baseboard Management Controller Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel panic causing system crash, or arbitrary code execution in kernel context.

🟠

Likely Case

Kernel crash leading to denial of service, or limited memory corruption affecting system stability.

🟢

If Mitigated

Minimal impact if proper kernel hardening (like KASLR, SMEP, SMAP) is enabled and driver is not loaded.

🌐 Internet-Facing: LOW - Requires local access to trigger the vulnerability via Wi-Fi scanning operations.

🏢 Internal Only: MEDIUM - Local users or processes with Wi-Fi interface access could exploit this for privilege escalation or DoS.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger Wi-Fi scan operations. No public exploit code has been disclosed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commit 74b6b20df8cfe90ada777d621b54c32e69e27cd7 and later versions

Vendor Advisory: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=74b6b20df8cfe90ada777d621b54c32e69e27cd7

Restart Required: Yes

Instructions:

1. Update Linux kernel to version 5.11.7 or later. 2. For older kernels, backport the fix from commit 74b6b20df8cfe90ada777d621b54c32e69e27cd7. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable rtl8188eu staging driver

linux

Prevent loading of the vulnerable driver module

echo 'blacklist rtl8188eu' >> /etc/modprobe.d/blacklist-rtl8188eu.conf
rmmod rtl8188eu

Restrict Wi-Fi scanning permissions

linux

Limit which users can perform Wi-Fi scan operations

🧯 If You Can't Patch

Disable the rtl8188eu driver module if not needed
Implement strict access controls to prevent unauthorized users from accessing Wi-Fi interfaces

🔍 How to Verify

Check if Vulnerable:

Check if rtl8188eu module is loaded: lsmod | grep rtl8188eu. Check kernel version: uname -r (if ≤5.11.6)

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is >5.11.6: uname -r. Check if fix commit is present: grep -r '74b6b20df8cfe90ada777d621b54c32e69e27cd7' /usr/src/linux

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages in /var/log/kern.log or dmesg
System crashes or reboots after Wi-Fi operations

Network Indicators:

Unusual Wi-Fi scanning patterns from local users

SIEM Query:

source="kern.log" AND "Oops" AND "rtl8188eu" OR source="dmesg" AND "panic"

📊 Metadata

CVE ID: CVE-2021-28660

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: March 17, 2021

Last Updated: November 21, 2024

🔗 References

http://www.openwall.com/lists/oss-security/2022/11/18/1 Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/11/21/2 Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=74b6b20df8cfe90ada777d621b54c32e69e27cd7 Mailing List,Patch,Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJPVQZPY3DHPV5I3IVNMSMO6D3PKZISX/
https://security.netapp.com/advisory/ntap-20210507-0008/ Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/11/18/1 Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/11/21/2 Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=74b6b20df8cfe90ada777d621b54c32e69e27cd7 Mailing List,Patch,Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJPVQZPY3DHPV5I3IVNMSMO6D3PKZISX/
https://security.netapp.com/advisory/ntap-20210507-0008/ Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Cloud Backup by Netapp

Debian Linux by Debian

Fedora by Fedoraproject

H300e Firmware by Netapp

H300s Firmware by Netapp

H410s Firmware by Netapp

H500e Firmware by Netapp

H500s Firmware by Netapp

H700e Firmware by Netapp

H700s Firmware by Netapp

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Solidfire Baseboard Management Controller Firmware by Netapp

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable rtl8188eu staging driver

Restrict Wi-Fi scanning permissions

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities