
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2021-47311 is a use-after-free (UAF) vulnerability discovered in the Linux kernel's Qualcomm EMAC driver. The vulnerability exists in the emac_remove function where the network device's private data (adpt) is accessed after being freed through free_netdev() call, potentially leading to system instability. The vulnerability affects Linux kernel versions from 4.9 through 5.14-rc1 (NVD).
The vulnerability occurs in the emac_remove function of the Qualcomm EMAC driver. The issue arises when the driver attempts to access the network device's private data after calling free_netdev(), which frees the memory containing this data. This improper sequence of operations results in a use-after-free condition. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).
The vulnerability can cause system instability and potential crashes in the network subsystem. According to Red Hat's assessment, while the use-after-free can disrupt network operations and lead to service interruptions, it does not directly expose sensitive data (Red Hat).
The vulnerability has been fixed by moving the free_netdev() call to the end of the emac_remove function. Users are advised to update their Linux kernel to a patched version. Red Hat recommends updating the affected packages as soon as possible, as no practical mitigation exists for this issue (Red Hat).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."