CVE-2021-47517

What it actually does

Race condition permits ethtool netlink operations on a net device after unregistration begins but before removal completes, resulting in use-after-free accesses to kobjects and netdev queues.

Why it matters to the business

Local attackers can trigger kernel crashes or undefined behavior on systems with dynamic network interfaces, leading to denial of service and potential privilege escalation in multi-tenant or containerized environments.

How an attack unfolds

An attacker with local access issues concurrent ethtool netlink commands while triggering net device unregistration; the kernel proceeds with operations on structures that are being torn down, producing use-after-free conditions such as those seen in netdev_queue_update_kobjects and kobject_get.

How to fix it

Apply the upstream kernel commit that gates ethtool netlink operations once unregistration has started; rebuild and deploy kernels containing the fix for all affected distributions.

How to confirm the fix worked

Verify that the running kernel contains the patch preventing ethtool operations on unregistering devices by inspecting netlink ethtool handlers and confirming absence of the vulnerable code path in ethnl_set_channels.

Typical attack path

1. Obtain local execution context on the target system
2. Trigger net device unregistration (for example via interface removal or namespace teardown)
3. Simultaneously invoke ethtool netlink operations such as set-channels on the same device
4. Kernel dereferences freed kobjects, causing KASAN-detected UAF or NULL dereference

How to detect it

Search kernel logs and crash dumps for KASAN use-after-free reports citing kobject_get during ethtool activity, especially around netif_set_real_num_tx_queues or veth_set_channels; correlate with ethtool process execution timestamps.

• BUG: KASAN: use-after-free in kobject_get
• netdev_queue_update_kobjects
• ethnl_set_channels
• veth_set_channels

What your security team should do

• Prioritize kernel updates on systems exposing ethtool netlink to unprivileged users
• Harden container runtimes and orchestration layers that frequently create or destroy virtual interfaces
• Monitor kernel logs for KASAN or use-after-free reports involving kobject_get and netdev_queue functions