CVE-2021-47571

What it actually does

Use-after-free vulnerability in _rtl92e_pci_disconnect() where free_rtllib() releases the dev pointer immediately before a subsequent dereference, allowing access to freed kernel memory.

Why it matters to the business

Systems using the affected wireless driver may experience kernel crashes, denial of service, or potential local privilege escalation, disrupting operations on Linux servers and devices with this hardware.

How an attack unfolds

An attacker with local access triggers PCI device disconnect on a system using the rtl8192e driver, causing the driver to free memory and then immediately reference the freed pointer, which can be exploited for code execution or crash.

How to fix it

Apply the upstream kernel patch that reorders operations in _rtl92e_pci_disconnect() to avoid use-after-free, or upgrade to a Linux kernel version containing the fix for staging/rtl8192e.

How to confirm the fix worked

Inspect kernel source for the corrected ordering after free_rtllib() in rtl8192e, verify device driver initialization does not reference freed structures, and test PCI disconnect on patched kernels.

Typical attack path

1. Obtain local access to a Linux system with rtl8192e hardware
2. Trigger or simulate PCI disconnect event for the wireless device
3. Force execution of _rtl92e_pci_disconnect() to dereference freed memory
4. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs and dmesg for rtl8192e related oops, use-after-free warnings, or panic traces during PCI hotplug or driver unload events; correlate with process activity around wireless device management.

• rtl8192e
• _rtl92e_pci_disconnect
• free_rtllib

What your security team should do

• Prioritize kernel updates on all systems exposing rtl8192e wireless hardware
• Audit for use of staging drivers and consider disabling or replacing affected hardware
• Monitor kernel logs for oops or panic entries involving rtl8192e during device events