CVE-2021-47068 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2021-47068?

CVE-2021-47068 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem. It allows local attackers to potentially crash the kernel or execute arbitrary code by binding two sockets to the same NFC local interface. Only systems with NFC hardware and the NFC subsystem enabled are affected.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem. It allows local attackers to potentially crash the kernel or execute arbitrary code by binding two sockets to the same NFC local interface. Only systems with NFC hardware and the NFC subsystem enabled are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions with the vulnerable NFC commits (specific versions vary by distribution). Check distribution advisories.

Operating Systems: Linux distributions with NFC support

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if NFC subsystem is enabled and hardware present. Most servers and many desktops are not affected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, leading to complete system compromise.

🟠

Likely Case

Kernel panic or denial of service causing system crash.

🟢

If Mitigated

No impact if NFC subsystem is disabled or hardware not present.

🌐 Internet-Facing: LOW - Requires local access to the system.

🏢 Internal Only: MEDIUM - Local attackers could exploit this if they have user access to affected systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Proof-of-concept code is included in the CVE description. Requires local user access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with fixes from the provided git commits

Vendor Advisory: https://git.kernel.org/stable/c/48fba458fe54cc2a980a05c13e6c19b8b2cfb610

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For RHEL/CentOS: yum update kernel. 3. For Ubuntu/Debian: apt update && apt upgrade linux-image. 4. Reboot system.

🔧 Temporary Workarounds

Disable NFC subsystem

linux

Remove NFC kernel module if not needed

rmmod nfc
echo 'blacklist nfc' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Disable NFC hardware in BIOS/UEFI if possible
Restrict local user access to systems with NFC hardware

🔍 How to Verify

Check if Vulnerable:

Check kernel version against distribution security advisories. Check if NFC module is loaded: lsmod | grep nfc

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and NFC module version matches patched kernel. Check dmesg for no related crashes.

📡 Detection & Monitoring

Log Indicators:

Kernel oops or panic messages in dmesg/syslog related to nfc or llcp_sock

Network Indicators:

Unusual NFC socket activity from local users

SIEM Query:

source="kernel" AND ("nfc" OR "llcp_sock" OR "use-after-free")

📊 Metadata

CVE ID: CVE-2021-47068

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: February 29, 2024

Last Updated: April 22, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47068, you might also want to check these: