CVE-2021-47586·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup KASAN reports an out-of-bounds read in rk_gmac_setup on the line: while (ops->regs[i]) { This happens for most platforms since the regs flexible array member is empty, so the memory after the ops structure is being read here. It seems that mostly this happens to contain zero anyway, so we get lucky and everything still works. To avoid adding redundant data to nearly all the ops structures, add a new flag to indicate whether the regs field is valid and avoid this loop when it is not.
- Severity
- medium
- Software
- Kernel
- Fixed in
- 5.15.11
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — higher than 4% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 5.14
Until: 5.15.11
Fixed in: 5.15.11
How to fix this CVE
Update your Linux kernel to version 5.15.11 or later to resolve this out-of-bounds memory read vulnerability in the stmmac dwmac-rk driver. The fix adds a validation flag to prevent reading beyond allocated memory in the regs array during network interface initialization. Systems running kernel versions 5.14 through 5.15.10 should prioritize this update to eliminate the potential for memory corruption.
sudo dnf update kernel kernel-develDefensia detects this vulnerability
How to check if you are affected
- Check your kernel version: uname -r | grep -E '^5\.(14|15\.[0-9]|15\.10)'
- Verify stmmac driver is loaded: lsmod | grep stmmac
- Check dmesg for KASAN warnings: dmesg | grep -i 'kasan\|out-of-bounds'
- Confirm patch applied: grep -r 'regs_valid\|ops->regs' /boot/config-$(uname -r) || echo 'Vulnerable version detected'
FAQ
What is CVE-2021-47586?
This is an out-of-bounds memory read vulnerability in the Linux kernel's stmmac Rockchip dwmac driver initialization. The driver attempted to iterate through a flexible array member without checking if the array contained valid data, leading to reads of uninitialized kernel memory adjacent to the ops structure.
Is CVE-2021-47586 being actively exploited?
No, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and no public exploits are available. However, it represents a real memory safety issue that could potentially be weaponized.
What versions of Kernel are affected by CVE-2021-47586?
Linux kernel versions 5.14 through 5.15.10 are affected. The vulnerability was fixed in kernel 5.15.11.
How do I check if my server is vulnerable to CVE-2021-47586?
Run 'uname -r' and check if the output matches 5.14.* or 5.15.[0-9] or 5.15.10. If it does, your system is vulnerable and requires a kernel update.
Does Defensia detect CVE-2021-47586?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If the Linux kernel is installed on a monitored server, CVE-2021-47586 will appear in your dashboard with remediation steps.
Related Kernel CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2021-47586. Free for 1 server.
Get started free