CVE-2021-47560

When processing port up/down events generated by the device's firmware, the driver protects itself from events reported for non-existent local ports, but not the CPU port (local port 0), which exists, but lacks a netdev.

This can result in a NULL pointer dereference when calling netifcarrier{on,off}().

Fix this by bailing early when processing an event reported for the CPU port. Problem was only observed when running on top of a buggy emulator.

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47560.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "5.4"
            },
            {
                "fixed": "5.10.83"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.11"
            },
            {
                "fixed": "5.15.6"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "5.16-rc1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "5.16-rc2"
            }
        ]
    }
]