CVE-2021-47369

What it actually does

NULL pointer dereference in qeth_clear_working_pool_list() when card->qdio.in_q has not yet been allocated by qeth_alloc_qdio_queues(), resulting in writes that corrupt the CPU lowcore and trigger a crash on the next machine-check interrupt.

Why it matters to the business

s390 Linux systems using the qeth network driver may experience unexpected kernel crashes during device bring-up when early I/O errors or certain misconfigurations occur, causing availability loss and potential service disruption.

How an attack unfolds

An attacker with the ability to trigger qeth_set_online() (via local privileges or device misconfiguration) forces an error exit from qeth_hardsetup_card() before qdio queues are allocated; the subsequent call to qeth_clear_working_pool_list() then dereferences the still-NULL in_q pointer and scribbles lowcore memory.

How to fix it

Update the Linux kernel to commit bcf876870b95592b52519ed4aafcf9d95999bc9c or later; apply the NULL-pointer guard inside qeth_clear_working_pool_list().

How to confirm the fix worked

Confirm presence of the NULL check before dereferencing card->qdio.in_q in qeth_clear_working_pool_list(); verify the fixed commit is present in the running kernel source or binary.

Typical attack path

1. Obtain local access or ability to induce device configuration or I/O errors
2. Invoke qeth_set_online() or equivalent online operation on an uninitialized qeth device
3. Force error path in qeth_hardsetup_card() leaving card->qdio.in_q NULL
4. Execute qeth_clear_working_pool_list() which dereferences the NULL pointer and corrupts lowcore

How to detect it

Inspect kernel logs and crash dumps for oops or panic messages mentioning qeth_clear_working_pool_list, qeth_hardsetup_card, or lowcore memory corruption; correlate with qeth device online attempts that failed.

What your security team should do

• Apply the referenced kernel commit to all affected s390 systems
• Review qeth device configurations to reduce likelihood of early setup errors
• Monitor kernel logs for oops/panics referencing qeth or lowcore corruption