CVE-2021-47388

What it actually does

Use-after-free in mac80211 CCMP/GCMP RX PN checking for fragmented frames caused by referencing a stale 'hdr' pointer after possible buffer reallocation during defragmentation.

Why it matters to the business

Remote attackers could crash wireless Linux systems or potentially execute code, disrupting network operations or enabling compromise on Wi-Fi devices; low observed exploitation risk reduces immediate urgency.

How an attack unfolds

An attacker sends specially crafted fragmented 802.11 frames that force reallocation during PN comparison in the RX path, allowing use of a freed pointer to corrupt kernel memory.

How to fix it

Apply the upstream kernel patch that reloads the header variable after any reallocation; update to a Linux kernel version containing the fix for CVE-2021-47388.

How to confirm the fix worked

Verify the patch is present by inspecting mac80211 RX code for the reload of the header pointer after potential reallocations; test with fragmented CCMP/GCMP frames in a lab environment.

Typical attack path

1. Transmit malicious fragmented 802.11 frames targeting mac80211 RX
2. Trigger frame reallocation in defragmentation logic
3. Reference freed 'hdr' variable for PN check
4. Achieve memory corruption or crash

How to detect it

Review kernel logs and wireless driver traces for use-after-free warnings or crashes in mac80211 RX paths involving CCMP/GCMP fragmentation; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on all wireless Linux systems
• Monitor for any future EPSS increases or KEV inclusion
• Limit exposure of affected wireless interfaces where possible