CVE-2021-47547

What it actually does

Out-of-bounds array access in the de4x5 Linux kernel driver where the index k reaches 8 after iterating lp->phy[8] without bounds checking, enabling memory corruption via buffer overflow.

Why it matters to the business

Systems using legacy Tulip/de4x5 Ethernet hardware on unpatched kernels face risk of crashes or potential code execution, increasing downtime and security exposure on affected Linux deployments.

How an attack unfolds

An attacker supplies or manipulates PHY identifiers so that all eight lp->phy entries are nonzero, causing the loop to exit with k equal to 8; subsequent access to lp->phy[k] then reads or writes outside the array bounds, leading to kernel memory corruption.

How to fix it

Upgrade to a Linux kernel containing the upstream fix that prevents the index from exceeding the lp->phy array size; rebuild and deploy the updated kernel image on affected hosts.

How to confirm the fix worked

Inspect kernel source for the corrected loop termination logic or apply the published patch; confirm the driver no longer permits k to reach 8 before array access; test hardware initialization under maximum PHY conditions.

Typical attack path

1. Locate a system running a vulnerable kernel version with the de4x5 driver loaded
2. Trigger driver probe or PHY scanning with crafted or all-nonzero PHY IDs
3. Force the loop termination condition that sets k to 8
4. Cause subsequent array access that overflows bounds and corrupts adjacent kernel memory

How to detect it

Review kernel logs for de4x5 or tulip driver oops/panic messages indicating array bounds violations; search dmesg and syslog for references to phy array access during driver initialization.

What your security team should do

• Prioritize kernel updates on any hosts still using the tulip or de4x5 driver
• Audit for presence of legacy DEC Ethernet hardware and replace where feasible
• Disable the de4x5 module via modprobe blacklist if the hardware is not required
• Monitor kernel update channels for backported fixes in supported distributions