CVE-2021-47372

What it actually does

Use-after-free in macb_remove due to accessing pclk and hclk after platform_device_unregister releases platform_data, triggered on driver unload.

Why it matters to the business

Local unprivileged or root users can trigger kernel crashes or memory corruption on systems using the macb Ethernet driver, leading to denial of service or potential privilege escalation; low exploitability reduces urgency but still requires patching in affected kernels.

How an attack unfolds

An attacker with local access loads or ensures the macb_pci driver is active, then triggers module removal (rmmod) to execute the flawed remove path, dereferencing freed platform_data pointers for KASAN-detected use-after-free that may be turned into arbitrary read/write or control flow hijack.

How to fix it

Update to a Linux kernel containing the fix for CVE-2021-47372; reorder platform_device_unregister after clk handling in macb_remove or apply vendor backports.

How to confirm the fix worked

Verify kernel source contains the adjusted call sequence in macb_remove; test module load/unload cycles with KASAN enabled to confirm no use-after-free; check dmesg for absence of the reported BUG.

Typical attack path

1. Obtain local shell on target Linux system
2. Ensure macb or macb_pci driver is loaded
3. Execute rmmod macb_pci or equivalent to invoke macb_remove
4. Trigger use-after-free on pclk/hclk access for crash or exploitation

How to detect it

Search kernel logs for KASAN use-after-free reports mentioning macb_remove or macb_pci; audit module unload events via auditd or journalctl for unexpected macb driver removals; examine crash dumps for platform_device_release followed by macb access patterns.

• BUG: KASAN: use-after-free in macb_remove
• macb_pci
• platform_device_release

What your security team should do

• Prioritize kernel upgrade on all systems exposing macb Ethernet hardware
• Restrict unprivileged module unloading via kernel module signing and CAP_SYS_MODULE controls
• Monitor for local privilege escalation attempts involving network drivers