CVE-2021-47159

What it actually does

Negative error return from get_sset_count is promoted to a huge unsigned value; an unsigned loop counter then walks far beyond intended bounds, performing unbounded memory writes that corrupt kernel structures until the system crashes.

Why it matters to the business

Unexpected kernel crashes on Linux systems that expose DSA switch statistics, producing denial of service and potential loss of network connectivity or data-plane stability.

How an attack unfolds

An attacker with local access triggers ethtool or similar statistics collection against a DSA device whose get_sset_count implementation returns an error; the resulting unsigned-integer wrap produces a long-running corruptive loop that either panics the kernel or leaves the system in a corrupted state.

How to fix it

Apply the upstream fix that adds an error check before the loop and changes the loop variable from unsigned int to int; rebuild and boot the corrected kernel image.

How to confirm the fix worked

Confirm the patch is present by inspecting the DSA ethtool code for the error-return check and signed loop variable; re-test statistics queries after forcing get_sset_count failure to verify the loop no longer overruns.

Typical attack path

1. Obtain local shell or user context on a Linux host using DSA networking
2. Invoke ethtool -S or equivalent statistics query on the DSA interface
3. Force get_sset_count to fail (driver-dependent error path)
4. Unsigned loop variable overflows and performs repeated out-of-bounds writes
5. Kernel memory corruption leads to crash or exploitable state

How to detect it

Review kernel logs for oops or panic messages containing dsa, get_sset_count, or ethtool; correlate with recent invocation of statistics queries on DSA devices.

What your security team should do

• Prioritize kernel updates on all systems exposing DSA interfaces
• Restrict unprivileged ethtool access via capabilities or SELinux policies until patched
• Monitor for unexpected kernel oops or panics referencing DSA or ethtool paths