CVE-2021-47586

What it actually does

Out-of-bounds read when a loop iterates over an empty flexible array member in rk_gmac_setup, accessing memory immediately following the ops structure.

Why it matters to the business

May cause kernel instability, crashes, or limited information exposure on Rockchip-based Ethernet devices running affected kernels, increasing operational risk and potential downtime for embedded or Android systems.

How an attack unfolds

An attacker triggers driver initialization or device setup on a vulnerable Rockchip platform, causing the kernel to read past the intended structure boundary; in most cases memory contains zeros so the issue remains latent unless non-zero data enables further abuse.

How to fix it

Apply the upstream fix that adds a validity flag for the regs field and skips the loop when the field is unused; rebuild and deploy the patched kernel.

How to confirm the fix worked

Confirm the patch is present by checking that rk_gmac_setup now tests a new flag before accessing the regs array, or run KASAN-enabled boot tests on affected hardware.

Typical attack path

1. Locate system using dwmac-rk driver on vulnerable kernel
2. Cause rk_gmac_setup to execute during probe or configuration
3. Trigger the while (ops->regs[i]) loop to perform out-of-bounds read
4. Observe kernel behavior or attempt to leverage any leaked data

How to detect it

Search kernel logs and KASAN reports for out-of-bounds read messages referencing rk_gmac_setup or dwmac-rk; inspect driver load sequences during boot or hotplug events.

What your security team should do

• Prioritize kernel updates for any Rockchip Ethernet deployments
• Enable KASAN or similar memory debugging on test systems to surface similar issues
• Review downstream device trees and driver configurations for unnecessary ops structures