CVE-2021-47355

What it actually does

The nicstar ATM driver uses del_timer() in its module removal path instead of del_timer_sync(), allowing the timer handler to continue executing after the driver's data structures have been freed and resulting in a use-after-free condition.

Why it matters to the business

Systems using the affected ATM driver risk kernel crashes, denial of service, or potential privilege escalation during module unload or driver removal operations, which can disrupt network services and require emergency reboots or patches.

How an attack unfolds

An attacker with sufficient privileges to trigger module removal or device hot-unplug on a system running the vulnerable nicstar driver races the cleanup routine so that the still-running timer handler accesses freed memory, enabling memory corruption that may be turned into arbitrary kernel code execution.

How to fix it

Upgrade the Linux kernel to a version containing the fix that replaces del_timer() with del_timer_sync() in nicstar_cleanup(); rebuild and reboot with the updated kernel; disable or blacklist the nicstar module if the hardware is not required.

How to confirm the fix worked

Inspect the nicstar.c source for the call to del_timer_sync() in the remove path; verify the running kernel version contains the upstream commit; attempt module removal under load while monitoring for use-after-free warnings in dmesg or kmemleak.

Typical attack path

1. Obtain local or administrative access to the target Linux system
2. Identify presence of the nicstar ATM driver and load or attach a device that registers the timer
3. Trigger driver removal via rmmod, hot-unplug, or shutdown sequence
4. Race the del_timer() window so the handler runs after resources are freed
5. Leverage the resulting use-after-free for memory corruption and privilege escalation

How to detect it

Review kernel logs for use-after-free or timer-related warnings during nicstar module unload; correlate module removal events with subsequent crashes or memory corruption reports; examine audit logs for unexpected rmmod or device removal activity on systems that should not unload this driver.

What your security team should do

• Prioritize kernel updates on any systems exposing ATM or nicstar hardware
• Audit module lists and remove unnecessary ATM drivers from production kernels
• Add kernel module removal events to monitoring pipelines for early anomaly detection
• Test updated kernels in staging environments before broad deployment