CVE-2021-47135

What it actually does

The flaw permits an array out-of-bounds read or write in mt7921_mcu_tx_rate_report within the mt76/mt7921 wireless driver due to missing bounds checks on transmission rate report data.

Why it matters to the business

Kernel memory corruption on systems with MediaTek mt7921 hardware can cause system instability, crashes, or potential code execution; the large number of affected container packages on AlmaLinux 8 indicates broad downstream exposure in virtualized and containerized workloads, though low EPSS and absence from KEV indicate limited real-world risk.

How an attack unfolds

An attacker with the ability to interact with the mt7921 wireless interface supplies a crafted transmission rate report to the MCU handler, triggering the unchecked array access and resulting memory corruption that may be leveraged for denial of service or privilege escalation.

How to fix it

Update the listed AlmaLinux 8 packages to the exact fixed versions: oci-systemd-hook to 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082, oci-umount to 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082, fuse-overlayfs to 0.3-5.module_el8.3.0+2044+12421f43, criu to 3.12-9.module_el8.4.0+2496+12421f43, crit to 3.12-9.module_el8.3.0+2044+12421f43, python3-criu to 3.12-9.module_el8.3.0+2044+12421f43, slirp4netns to 0.1-5.dev.gitc4e1bc5.module_el8.3.0+2044+12421f43, containernetworking-plugins to 0.7.4-4.git9ebe139.module_el8.3.0+2044+12421f43, container-selinux to 2:2.124.0-1.gitf958d0c.module_el8.3.0+2044+12421f43, buildah to 1.5-8.gite94b4f9.module_el8.5.0+119+9a9ec082, containers-common to 1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43, runc to 1.0.0-56.rc5.dev.git2abd837.module_el8.3.0+2044+12421f43, and skopeo to 1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43; apply any corresponding kernel updates that include the mt7921 driver fix.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed module versions above and verify the mt7921 driver no longer exhibits the bounds issue through source inspection or kernel crash testing with crafted rate reports.

Typical attack path

1. Gain proximity or network access to a vulnerable mt7921-equipped device
2. Trigger transmission of a maliciously formatted rate report via the wireless interface
3. Cause out-of-bounds memory access in the driver handler
4. Leverage resulting corruption for crash or code execution

How to detect it

Review kernel logs for oops or panic messages referencing mt7921_mcu_tx_rate_report or array bounds violations in the mt76 driver; correlate with wireless interface activity or unexpected process terminations in container runtimes.

What your security team should do

• Prioritize patching the listed container packages on all AlmaLinux 8 systems within standard change windows given the low EPSS and lack of KEV listing
• Audit wireless hardware inventories for mt7921 presence and schedule kernel updates accordingly
• Monitor EPSS trend and threat intelligence feeds for any increase in exploitation activity