Cloudanix VulnDB

CVE-2021-47023

High · 8.2

CVSS

8.2

EPSS

0.8%

Published

Feb 28, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A timing bug in Linux network code for certain switch chips can make the whole machine crash when ports are first set up.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in the Prestera driver during port initialization allows firmware to deliver an initial port-down event, leading to cancel_delayed_work being invoked on an uninitialized work structure and a subsequent kernel paging fault.

Why it matters to the business

Network devices using Marvell Prestera hardware may suffer kernel crashes and reboots at boot or interface bring-up time, producing unplanned downtime and loss of connectivity.

How an attack unfolds

An attacker or misbehaving firmware timing delivers a port-down notification concurrently with driver port creation; the event handler then calls cancel_delayed_work without verifying the prior port state, dereferencing invalid memory and triggering an oops.

How to fix it

Apply a kernel containing the upstream fix that only cancels the port-stats work item when the previous port state was up-and-running.

How to confirm the fix worked

Confirm the running kernel contains the state-check guard inside prestera_port_handle_event before any call to cancel_delayed_work.

Typical attack path

  1. Initiate Prestera driver port creation
  2. Cause firmware to emit an early port-down event
  3. Invoke cancel_delayed_work on an uninitialized delayed_work
  4. Trigger kernel paging fault and crash

How to detect it

Search kernel logs and boot traces for oops entries containing get_work_pool, cancel_delayed_work, prestera_port_handle_event, and prestera_fw_evt_work_fn.

  • prestera_port_handle_event
  • prestera_fw_evt_work_fn
  • get_work_pool+0x48/0x60
  • Unable to handle kernel paging request at virtual address
  • Workqueue: prestera_fw_wq

What your security team should do

  • Apply the corrected kernel to all systems containing Prestera hardware
  • Reboot test affected devices after patching to verify clean port initialization
  • Add kernel-oops monitoring for prestera modules

The record

In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix port event handling on init For some reason there might be a crash during ports creation if port events are handling at the same time because fw may send initial port event with down state. The crash points to cancel_delayed_work() which is called when port went is down. Currently I did not find out the real cause of the issue, so fixed it by cancel port stats work only if previous port's state was up & runnig. The following is the crash which can be triggered: [ 28.311104] Unable to handle kernel paging request at virtual address 000071775f776600 [ 28.319097] Mem abort info: [ 28.321914] ESR = 0x96000004 [ 28.324996] EC = 0x25: DABT (current EL), IL = 32 bits [ 28.330350] SET = 0, FnV = 0 [ 28.333430] EA = 0, S1PTW = 0 [ 28.336597] Data abort info: [ 28.339499] ISV = 0, ISS = 0x00000004 [ 28.343362] CM = 0, WnR = 0 [ 28.346354] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000100bf7000 [ 28.352842] [000071775f776600] pgd=0000000000000000, p4d=0000000000000000 [ 28.359695] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 28.365310] Modules linked in: prestera_pci(+) prestera uio_pdrv_genirq [ 28.372005] CPU: 0 PID: 1291 Comm: kworker/0:1H Not tainted 5.11.0-rc4 #1 [ 28.378846] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 28.384283] Workqueue: prestera_fw_wq prestera_fw_evt_work_fn [prestera_pci] [ 28.391413] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--) [ 28.397468] pc : get_work_pool+0x48/0x60 [ 28.401442] lr : try_to_grab_pending+0x6c/0x1b0 [ 28.406018] sp : ffff80001391bc60 [ 28.409358] x29: ffff80001391bc60 x28: 0000000000000000 [ 28.414725] x27: ffff000104fc8b40 x26: ffff80001127de88 [ 28.420089] x25: 0000000000000000 x24: ffff000106119760 [ 28.425452] x23: ffff00010775dd60 x22: ffff00010567e000 [ 28.430814] x21: 0000000000000000 x20: ffff80001391bcb0 [ 28.436175] x19: ffff00010775deb8 x18: 00000000000000c0 [ 28.441537] x17: 0000000000000000 x16: 000000008d9b0e88 [ 28.446898] x15: 0000000000000001 x14: 00000000000002ba [ 28.452261] x13: 80a3002c00000002 x12: 00000000000005f4 [ 28.457622] x11: 0000000000000030 x10: 000000000000000c [ 28.462985] x9 : 000000000000000c x8 : 0000000000000030 [ 28.468346] x7 : ffff800014400000 x6 : ffff000106119758 [ 28.473708] x5 : 0000000000000003 x4 : ffff00010775dc60 [ 28.479068] x3 : 0000000000000000 x2 : 0000000000000060 [ 28.484429] x1 : 000071775f776600 x0 : ffff00010775deb8 [ 28.489791] Call trace: [ 28.492259] get_work_pool+0x48/0x60 [ 28.495874] cancel_delayed_work+0x38/0xb0 [ 28.500011] prestera_port_handle_event+0x90/0xa0 [prestera] [ 28.505743] prestera_evt_recv+0x98/0xe0 [prestera] [ 28.510683] prestera_fw_evt_work_fn+0x180/0x228 [prestera_pci] [ 28.516660] process_one_work+0x1e8/0x360 [ 28.520710] worker_thread+0x44/0x480 [ 28.524412] kthread+0x154/0x160 [ 28.527670] ret_from_fork+0x10/0x38 [ 28.531290] Code: a8c17bfd d50323bf d65f03c0 9278dc21 (f9400020) [ 28.537429] ---[ end trace 5eced933df3a080b ]---

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 5.10.38-1
Debian:12 linux 0 5.10.38-1
Debian:13 linux 0 5.10.38-1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 5.4.0-9.12
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1014.18~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1006.6
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1007.8~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1019.24~20.04.1.1
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1007.10
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1006.9~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 5.4.0-1008.9
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1003.5~20.04.2
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1003.4
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1003.5~20.04.1
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1001.3
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1004.4
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1007.9~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1007.7
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1015.17~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1020.24
Ubuntu:22.04:LTS linux 0 5.13.0-19.19
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 6.5.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-azure 0 5.13.0-1006.7
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 6.5.0-1007.7~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1019.24.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 6.5.0-1010.10~22.04.3
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 6.5.0-14.14~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-kvm 0 5.13.0-1004.4
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-22.22
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 6.5.0-14.14.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 6.5.0-1004.4
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 6.5.0-1003.3
Ubuntu:22.04:LTS linux-oracle 0 5.13.0-1008.10
Ubuntu:22.04:LTS linux-oracle-6.5 0 6.5.0-1013.13~22.04.4
Ubuntu:22.04:LTS linux-raspi 0 5.13.0-1008.9
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 6.5.0-17.17.1.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 6.5.0-1007.8~22.04.1
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 5.15.0-1022.26
Ubuntu:24.04:LTS linux 0 6.5.0-9.9
Ubuntu:24.04:LTS linux-aws 0 6.5.0-1008.8
Ubuntu:24.04:LTS linux-azure 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gcp 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1003.5
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1001.3
Ubuntu:24.04:LTS linux-ibm 0 6.5.0-1009.9
Ubuntu:24.04:LTS linux-lowlatency 0 6.5.0-9.9.1
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1007.7
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1009.9.1
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1003.3
Ubuntu:24.04:LTS linux-oracle 0 6.5.0-1010.10
Ubuntu:24.04:LTS linux-raspi 0 6.5.0-1005.7
Ubuntu:24.04:LTS linux-riscv 0 6.5.0-9.9.1
Ubuntu:Pro:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:Pro:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-hwe 0 No fix
Ubuntu:Pro:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-oem 0 No fix
Ubuntu:Pro:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-gke 0 No fix
Ubuntu:Pro:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:Pro:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:Pro:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-raspi2 0 No fix
Ubuntu:Pro:20.04:LTS linux-riscv 0 No fix
Ubuntu:Pro:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-aws-fips 0 4.15.0-2000.4
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-azure-fips 0 4.15.0-1002.2
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-fips 0 4.15.0-1027.32
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-gcp-fips 0 4.15.0-2013.14
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-aws-fips 0 5.4.0-1021.21+fips2
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-azure-fips 0 5.4.0-1022.22+fips1
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-fips 0 5.4.0-1026.30
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-gcp-fips 0 5.4.0-1021.21+fips1
Ubuntu:Pro:FIPS:16.04:LTS linux-fips 0 4.4.0-1003.3
Ubuntu:Pro:FIPS:18.04:LTS linux-aws-fips 0 4.15.0-2000.4
Ubuntu:Pro:FIPS:18.04:LTS linux-azure-fips 0 4.15.0-1002.2
Ubuntu:Pro:FIPS:18.04:LTS linux-fips 0 4.15.0-1011.12
Ubuntu:Pro:FIPS:18.04:LTS linux-gcp-fips 0 4.15.0-1001.1
Ubuntu:Pro:FIPS:20.04:LTS linux-aws-fips 0 5.4.0-1021.21+fips2
Ubuntu:Pro:FIPS:20.04:LTS linux-azure-fips 0 5.4.0-1022.22+fips1
Ubuntu:Pro:FIPS:20.04:LTS linux-fips 0 5.4.0-1007.8
Ubuntu:Pro:FIPS:20.04:LTS linux-gcp-fips 0 5.4.0-1021.21+fips1

Related vulnerabilities