CVE-2021-47541

What it actually does

Use-after-free in mlx4_en_try_alloc_resources() after mlx4_en_copy_priv() frees tmp->tx_cq on error, followed by dereference of the freed pointer in mlx4_en_alloc_resources().

Why it matters to the business

Local attackers on affected Linux systems using the mlx4_en driver may crash the kernel or escalate privileges, leading to denial of service or full system compromise on servers and appliances.

How an attack unfolds

An attacker with local access crafts conditions that cause mlx4_en_copy_priv() to fail, freeing the tx_cq structure, then triggers mlx4_en_alloc_resources() which dereferences the dangling pointer, resulting in memory corruption that can be leveraged for code execution.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix that adds the return-value check after mlx4_en_copy_priv() before calling mlx4_en_alloc_resources(). Rebuild and reboot with the patched kernel; no configuration changes required.

How to confirm the fix worked

Confirm the kernel source contains the added check of mlx4_en_copy_priv() return value in mlx4_en_try_alloc_resources(); verify running kernel version is newer than the vulnerable commit and that static analysis warnings are absent.

Typical attack path

1. Obtain local user or process execution on the target system
2. Load or interact with the mlx4_en module under CONFIG_MLX4_EN=m
3. Trigger error path in mlx4_en_copy_priv() to free tx_cq
4. Invoke mlx4_en_alloc_resources() to dereference freed memory
5. Exploit resulting memory corruption for privilege escalation or crash

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for use-after-free warnings or panics referencing mlx4_en_try_alloc_resources, mlx4_en_copy_priv, or tx_cq; inspect crash dumps for freed tx_cq dereferences; correlate with local process activity around mlx4_en module load.

What your security team should do

• Patch affected systems to a fixed kernel version as soon as possible
• Restrict local access and module loading for mlx4_en until patched
• Monitor kernel logs for oops or panic messages involving mlx4_en
• Test patched kernels in staging before broad deployment