CVE-2021-47101: asix: fix uninit-value in asix_mdio_read()
In the Linux kernel, the following vulnerability has been resolved:
asix: fix uninit-value in asixmdioread()
asixreadcmd() may read less than sizeof(smsr) bytes and in this case smsr will be uninitialized.
Fail log: BUG: KMSAN: uninit-value in asixcheckhostenable drivers/net/usb/asixcommon.c:82 [inline] BUG: KMSAN: uninit-value in asixcheckhostenable drivers/net/usb/asixcommon.c:82 [inline] drivers/net/usb/asixcommon.c:497 BUG: KMSAN: uninit-value in asixmdioread+0x3c1/0xb00 drivers/net/usb/asixcommon.c:497 drivers/net/usb/asixcommon.c:497 asixcheckhostenable drivers/net/usb/asixcommon.c:82 [inline] asixcheckhostenable drivers/net/usb/asixcommon.c:82 [inline] drivers/net/usb/asixcommon.c:497 asixmdioread+0x3c1/0xb00 drivers/net/usb/asixcommon.c:497 drivers/net/usb/asixcommon.c:497
Other sources
In the Linux kernel, the following vulnerability has been resolved:
asix: fix uninit-value in asixmdioread()
The Linux kernel CVE team has assigned CVE-2021-47101 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024030415-CVE-2021-47101-f3fa@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47101?
CVE-2021-47101 has a medium severity rating due to potential uninitialized value exposure in the Linux kernel's asix driver.
How do I fix CVE-2021-47101?
To fix CVE-2021-47101, update your Linux kernel to versions 5.15.12, 5.16, or the specified secure versions listed for Debian.
Which versions of the Linux kernel are affected by CVE-2021-47101?
CVE-2021-47101 affects several versions of the Linux kernel prior to 5.15.12 and various releases in the 5.16 and prior ranges.
Is CVE-2021-47101 exploitable in production environments?
CVE-2021-47101 may be exploitable in production environments if the vulnerable kernel version is deployed and facing network access.
Where can I find more information about CVE-2021-47101?
Detailed information and patches regarding CVE-2021-47101 can be found in the Linux kernel's release notes and security advisories.