Cloudanix VulnDB

CVE-2021-47349

None

CVSS

—

EPSS

0.2%

Published

May 21, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux wireless driver can cause the system to freeze when the driver is removed or reset, requiring a reboot to recover.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Deadlock occurs during mwifiex driver teardown or firmware reset because cfg80211_unregister_wdev acquires the wiphy lock while the interface is still up, leading to recursive mutex acquisition on the same lock.

Why it matters to the business

Unloading the wireless driver or recovering from firmware issues can hang the system for extended periods, disrupting wireless connectivity and requiring manual intervention or reboot in affected Linux environments.

How an attack unfolds

An attacker with local access triggers driver removal or firmware reset (via rmmod or equivalent), causing the netdevice notifier path to contend on the wiphy mutex already held during unregister, resulting in a hung task and potential denial of service.

How to fix it

Update to a kernel containing the fix that calls dev_close on the interface before cfg80211_unregister_wdev; for hashicorp/vault (GIT) apply commit a4cf0dc4437de35fce4860857b64569d092a9b5a or later.

How to confirm the fix worked

Confirm the presence of the link-down-before-delete sequence in mwifiex_del_virtual_intf and verify absence of the deadlock trace involving cfg80211_netdev_notifier_call and mutex_lock_nested during module removal.

Typical attack path

  1. Obtain local access to the target system
  2. Trigger mwifiex_pcie_remove or equivalent module unload path
  3. Force interface deletion without prior link down state
  4. Induce recursive lock acquisition via cfg80211 netdev notifier
  5. Observe prolonged mutex contention leading to hung task

How to detect it

Review kernel logs for hung task traces referencing mwifiex_del_virtual_intf, cfg80211_unregister_wdev, and mutex contention on wiphy; inspect dmesg for rmmod-induced deadlocks.

What your security team should do

  • Apply the referenced fixed commit immediately on systems using mwifiex wireless drivers
  • Monitor for hung task warnings during driver unload operations
  • Prioritize patching in environments where driver reload or firmware reset occurs frequently

The record

In the Linux kernel, the following vulnerability has been resolved: mwifiex: bring down link before deleting interface We can deadlock when rmmod'ing the driver or going through firmware reset, because the cfg80211_unregister_wdev() has to bring down the link for us, ... which then grab the same wiphy lock. nl80211_del_interface() already handles a very similar case, with a nice description: /* * We hold RTNL, so this is safe, without RTNL opencount cannot * reach 0, and thus the rdev cannot be deleted. * * We need to do it for the dev_close(), since that will call * the netdev notifiers, and we need to acquire the mutex there * but don't know if we get there from here or from some other * place (e.g. "ip link set ... down"). */ mutex_unlock(&rdev->wiphy.mtx); ... Do similarly for mwifiex teardown, by ensuring we bring the link down first. Sample deadlock trace: [ 247.103516] INFO: task rmmod:2119 blocked for more than 123 seconds. [ 247.110630] Not tainted 5.12.4 #5 [ 247.115796] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 247.124557] task:rmmod state:D stack: 0 pid: 2119 ppid: 2114 flags:0x00400208 [ 247.133905] Call trace: [ 247.136644] __switch_to+0x130/0x170 [ 247.140643] __schedule+0x714/0xa0c [ 247.144548] schedule_preempt_disabled+0x88/0xf4 [ 247.149714] __mutex_lock_common+0x43c/0x750 [ 247.154496] mutex_lock_nested+0x5c/0x68 [ 247.158884] cfg80211_netdev_notifier_call+0x280/0x4e0 [cfg80211] [ 247.165769] raw_notifier_call_chain+0x4c/0x78 [ 247.170742] call_netdevice_notifiers_info+0x68/0xa4 [ 247.176305] __dev_close_many+0x7c/0x138 [ 247.180693] dev_close_many+0x7c/0x10c [ 247.184893] unregister_netdevice_many+0xfc/0x654 [ 247.190158] unregister_netdevice_queue+0xb4/0xe0 [ 247.195424] _cfg80211_unregister_wdev+0xa4/0x204 [cfg80211] [ 247.201816] cfg80211_unregister_wdev+0x20/0x2c [cfg80211] [ 247.208016] mwifiex_del_virtual_intf+0xc8/0x188 [mwifiex] [ 247.214174] mwifiex_uninit_sw+0x158/0x1b0 [mwifiex] [ 247.219747] mwifiex_remove_card+0x38/0xa0 [mwifiex] [ 247.225316] mwifiex_pcie_remove+0xd0/0xe0 [mwifiex_pcie] [ 247.231451] pci_device_remove+0x50/0xe0 [ 247.235849] device_release_driver_internal+0x110/0x1b0 [ 247.241701] driver_detach+0x5c/0x9c [ 247.245704] bus_remove_driver+0x84/0xb8 [ 247.250095] driver_unregister+0x3c/0x60 [ 247.254486] pci_unregister_driver+0x2c/0x90 [ 247.259267] cleanup_module+0x18/0xcdc [mwifiex_pcie]

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 5.4.0-9.12
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1014.18~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1006.6
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1007.8~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1019.24~20.04.1.1
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1007.10
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1006.9~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 5.4.0-1008.9
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1003.5~20.04.2
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1003.4
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1003.5~20.04.1
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1001.3
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1004.4
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1007.9~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1007.7
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1015.17~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1020.24
Ubuntu:22.04:LTS linux 0 5.13.0-19.19
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 6.5.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-azure 0 5.13.0-1006.7
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 6.5.0-1007.7~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1019.24.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 6.5.0-1010.10~22.04.3
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 6.5.0-14.14~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-kvm 0 5.13.0-1004.4
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-22.22
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 6.5.0-14.14.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 6.5.0-1004.4
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 6.5.0-1003.3
Ubuntu:22.04:LTS linux-oracle 0 5.13.0-1008.10
Ubuntu:22.04:LTS linux-oracle-6.5 0 6.5.0-1013.13~22.04.4
Ubuntu:22.04:LTS linux-raspi 0 5.13.0-1008.9
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 6.5.0-17.17.1.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 6.5.0-1007.8~22.04.1
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 5.15.0-1022.26
Ubuntu:24.04:LTS linux 0 6.5.0-9.9
Ubuntu:24.04:LTS linux-aws 0 6.5.0-1008.8
Ubuntu:24.04:LTS linux-azure 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gcp 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1003.5
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1001.3
Ubuntu:24.04:LTS linux-ibm 0 6.5.0-1009.9
Ubuntu:24.04:LTS linux-lowlatency 0 6.5.0-9.9.1
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1007.7
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1009.9.1
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1003.3
Ubuntu:24.04:LTS linux-oracle 0 6.5.0-1010.10
Ubuntu:24.04:LTS linux-raspi 0 6.5.0-1005.7
Ubuntu:24.04:LTS linux-riscv 0 6.5.0-9.9.1
Ubuntu:Pro:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:Pro:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-hwe 0 No fix
Ubuntu:Pro:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-oem 0 No fix
Ubuntu:Pro:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-gke 0 No fix
Ubuntu:Pro:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:Pro:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:Pro:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-raspi2 0 No fix
Ubuntu:Pro:20.04:LTS linux-riscv 0 No fix
Ubuntu:Pro:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-aws-fips 0 4.15.0-2000.4
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-azure-fips 0 4.15.0-1002.2
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-fips 0 4.15.0-1027.32
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-gcp-fips 0 4.15.0-2013.14
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-aws-fips 0 5.4.0-1021.21+fips2
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-azure-fips 0 5.4.0-1022.22+fips1
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-fips 0 5.4.0-1026.30
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-gcp-fips 0 5.4.0-1021.21+fips1
Ubuntu:Pro:FIPS:16.04:LTS linux-fips 0 4.4.0-1003.3
Ubuntu:Pro:FIPS:18.04:LTS linux-aws-fips 0 4.15.0-2000.4
Ubuntu:Pro:FIPS:18.04:LTS linux-azure-fips 0 4.15.0-1002.2
Ubuntu:Pro:FIPS:18.04:LTS linux-fips 0 4.15.0-1011.12
Ubuntu:Pro:FIPS:18.04:LTS linux-gcp-fips 0 4.15.0-1001.1
Ubuntu:Pro:FIPS:20.04:LTS linux-aws-fips 0 5.4.0-1021.21+fips2
Ubuntu:Pro:FIPS:20.04:LTS linux-azure-fips 0 5.4.0-1022.22+fips1
Ubuntu:Pro:FIPS:20.04:LTS linux-fips 0 5.4.0-1007.8
Ubuntu:Pro:FIPS:20.04:LTS linux-gcp-fips 0 5.4.0-1021.21+fips1

Related vulnerabilities