CVE-2021-47065
📋 TL;DR
This is an array index out-of-bounds vulnerability in the Linux kernel's Realtek rtw88 wireless driver. It allows local attackers to cause kernel memory corruption when scanning wireless networks, potentially leading to system crashes or privilege escalation. Systems using Realtek wireless chips with the affected driver are vulnerable.
💻 Affected Systems
- Linux kernel with Realtek rtw88 wireless driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to denial of service, or potential privilege escalation through memory corruption leading to arbitrary code execution in kernel context.
Likely Case
System crash or kernel panic when wireless scanning occurs on channel 14, causing denial of service.
If Mitigated
Minor performance impact or failed wireless operations on specific channels if proper bounds checking is implemented.
🎯 Exploit Status
The vulnerability was discovered through UBSAN (Undefined Behavior Sanitizer) testing, suggesting it may not be actively exploited in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel versions with fixes from the provided git commits
Vendor Advisory: https://git.kernel.org/stable/c/2ff25985ea9ccc6c9af2c77b0b49045adcc62e0e
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix. 2. Rebuild kernel if using custom kernel. 3. Reboot system to load patched kernel.
🔧 Temporary Workarounds
Disable affected wireless interface
linuxPrevent use of the vulnerable rtw88 driver by disabling the wireless interface
sudo ip link set wlan0 down
sudo rfkill block wifi
Blacklist rtw88 module
linuxPrevent loading of the vulnerable driver module
echo 'blacklist rtw88_core' | sudo tee /etc/modprobe.d/blacklist-rtw88.conf
sudo update-initramfs -u
sudo reboot
🧯 If You Can't Patch
- Restrict wireless scanning capabilities to prevent triggering the vulnerability
- Use alternative wireless hardware or drivers if available
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if rtw88 module is loaded: 'uname -r' and 'lsmod | grep rtw88'Check Version:
uname -rVerify Fix Applied:
Verify kernel version is updated beyond vulnerable range and check for presence of fix commits in kernel source📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- UBSAN array-index-out-of-bounds warnings
- Wireless driver crash messages
Network Indicators:
- Unexpected wireless interface disconnections
- Failed scan operations on channel 14
SIEM Query:
kernel: "array-index-out-of-bounds" OR "rtw88" AND "panic" OR "Oops"🔗 References
- https://git.kernel.org/stable/c/2ff25985ea9ccc6c9af2c77b0b49045adcc62e0e
- https://git.kernel.org/stable/c/5f3dbced8eaa5c9ed7d6943f3fea99f235a6516a
- https://git.kernel.org/stable/c/6b5aa0cf321c25f41e09a61c83ee4dc7ab9549cb
- https://git.kernel.org/stable/c/95fb153c6027924cda3422120169d1890737f3a0
- https://git.kernel.org/stable/c/9cd09722e18a08b6a3d68b8bccfac39ddc22434c
- https://git.kernel.org/stable/c/2ff25985ea9ccc6c9af2c77b0b49045adcc62e0e
- https://git.kernel.org/stable/c/5f3dbced8eaa5c9ed7d6943f3fea99f235a6516a
- https://git.kernel.org/stable/c/6b5aa0cf321c25f41e09a61c83ee4dc7ab9549cb
- https://git.kernel.org/stable/c/95fb153c6027924cda3422120169d1890737f3a0
- https://git.kernel.org/stable/c/9cd09722e18a08b6a3d68b8bccfac39ddc22434c
