CVE-2021-47369: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a NULL pointer dereference vulnerability (CVE-2021-47369) was discovered in the s390/qeth subsystem. The issue occurs when qeth_set_online() calls qeth_clear_working_pool_list() to roll back after an error exit from qeth_hardsetup_card(), where there is a risk of accessing card->qdio.in_q before it was allocated by qeth_alloc_qdio_queues() via qeth_mpc_initialize() (Kernel Git).

The vulnerability exists in the qeth_clear_working_pool_list() function where it dereferences NULL and writes to queue->bufs[i].pool_entry, which can corrupt the CPU's lowcore memory. This scenario typically occurs when the device is first set online and its queues aren't allocated yet. An early IO error or certain misconfigurations (e.g., mismatched transport mode, bad portno) cause an error exit from qeth_hardsetup_card() with card->qdio.in_q still being NULL. The issue has a CVSS 3.1 Base Score of 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (NVD).

When exploited, this vulnerability results in a crash when the corrupted lowcore areas are accessed next (e.g., on the next machine-check interrupt). The issue can also occur in rare paths inside qeth_mpc_initialize() where a configuration change can cause existing queues to be freed, expecting subsequent code to reallocate them (Kernel Git).

The vulnerability requires local access and can be triggered through specific error conditions during device initialization or configuration changes. It primarily affects systems using the s390/qeth network device driver (NVD).

The issue has been fixed by adding a NULL pointer check before accessing the queue pointer in qeth_clear_working_pool_list(). The fix ensures that if the queue is NULL, the function returns before attempting to access the buffer entries (Kernel Git).