CVE-2021-47521

What it actually does

Use-after-free in ems_pcmcia_add_card() where a freed dev pointer is referenced after the final channel fails to initialize; the fix substitutes pdev->irq and adds a check ensuring at least one channel was configured.

Why it matters to the business

Local attackers on systems using the affected PCMCIA CAN controller can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation; the issue affects embedded and industrial Linux deployments that rely on this legacy hardware.

How an attack unfolds

An attacker with local access loads or triggers the sja1000 PCMCIA driver under conditions where the last channel cannot be initialized, causing the use-after-free; the freed object can then be reused to corrupt kernel memory and achieve code execution.

How to fix it

Apply the upstream fix that replaces the freed pointer with pdev->irq and adds the channel-count guard; rebuild and deploy a patched kernel image to all affected systems; disable the sja1000 PCMCIA driver if the hardware is not required.

How to confirm the fix worked

Confirm the running kernel contains the commit that removes the use of the freed dev pointer and adds the one-channel minimum check; attempt to load the driver with deliberately unavailable final channels and verify no oops or use-after-free warnings appear in dmesg.

Typical attack path

1. Obtain local shell or user context on the target Linux system
2. Ensure the ems_pcmcia sja1000 driver is loaded with PCMCIA hardware present
3. Trigger device addition with the final channel unavailable to hit the freed dev reference
4. Reuse the dangling pointer via crafted allocations to corrupt kernel structures
5. Escalate to ring-0 code execution or induce a kernel panic

How to detect it

Search kernel logs for oops or slab-use-after-free warnings referencing ems_pcmcia_add_card or sja1000; correlate with PCMCIA device insertion events around the same timestamp.

What your security team should do

• Patch kernels on all systems exposing the sja1000 PCMCIA driver within the next maintenance window
• Audit inventories for legacy PCMCIA CAN hardware and decommission where possible
• Add the driver to blocklists on general-purpose systems that do not need CAN support
• Monitor for future backports to long-term stable kernels still in use