CVE-2021-47586
📋 TL;DR
This CVE describes an out-of-bounds read vulnerability in the Linux kernel's STMMAC Ethernet driver for Rockchip platforms. An attacker could potentially read kernel memory beyond allocated bounds, which could lead to information disclosure or system instability. Systems running affected Linux kernel versions with the dwmac-rk driver are vulnerable.
💻 Affected Systems
- Linux kernel with dwmac-rk driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel memory information disclosure leading to privilege escalation or system crash
Likely Case
System instability or crash due to reading invalid memory regions
If Mitigated
Minor performance impact or no effect if memory happens to contain zeros
🎯 Exploit Status
Exploitation requires local access and specific conditions to trigger the vulnerable code path
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing commits 0546b224cc7717cc8a2db076b0bb069a9c430794 or 0b4a5d1e15ce72f69be48f38dc0401dab890ae0f
Vendor Advisory: https://git.kernel.org/stable/c/0546b224cc7717cc8a2db076b0bb069a9c430794
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Disable vulnerable driver module
linuxPrevent loading of the dwmac-rk driver if not needed
echo 'blacklist dwmac-rk' >> /etc/modprobe.d/blacklist.conf
rmmod dwmac-rk
🧯 If You Can't Patch
- Restrict local access to systems using network segmentation
- Implement strict access controls and monitoring for systems with vulnerable kernels
🔍 How to Verify
Check if Vulnerable:
Check if dwmac-rk driver is loaded: lsmod | grep dwmac-rk AND check kernel version against patched versionsCheck Version:
uname -rVerify Fix Applied:
Verify kernel version includes fix commits and dwmac-rk driver loads without errors📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages
- KASAN reports of out-of-bounds reads
- System crashes related to network driver
Network Indicators:
- Unusual network driver behavior on Rockchip systems
SIEM Query:
kernel: *oob* OR kernel: *KASAN* OR kernel: *dwmac-rk*