CVE-2021-46998 is a critical vulnerability found in the Cisco ENIC (Ethernet NIC) driver of the Linux Kernel. This bug could lead to a _use-after-free_ scenario, potentially enabling attackers to cause a kernel crash (DoS) or escalate privileges. This long-read post breaks down the vulnerability, explains the root cause, shows code snippets, links to original references, and describes how the patch resolves the issue. All in simple, straightforward language.

What's The Vulnerability?

The problem lies in the file that handles transmitting packets (enic_hard_start_xmit) in the ENIC driver. The bug occurs when an error happens while queuing a packet. The code accidentally keeps using a pointer (skb) to a packet after it’s already been freed—this is what's called a “use-after-free.”

Let’s look at a simplified version of the buggy logic

// enic_hard_start_xmit called when sending packets out
static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb,
                                        struct net_device *netdev){
    // ... some code ...
    err = enic_queue_wq_skb(vdev, skb); // Try to queue the skb
    if (err) {
        // On error, what happens?
        // skb could have been freed inside enic_queue_wq_skb()
    }
    skb_tx_timestamp(skb); // <-- POTENTIAL USE-AFTER-FREE!
    // ... more code ...
}

How Do We Exploit It?

To exploit this, an attacker could send specially crafted packets that trigger the error path in enic_queue_wq_skb, making skb be freed. Then, when the driver tries to use skb_tx_timestamp(skb), the kernel references freed memory. Attackers could use this to:

Patch & Solution

The fix is simple and smart. If enic_queue_wq_skb() fails, the code must not touch skb anymore. The patch by Govind checks for an error, and jumps straight to clean up—without using skb again.

Here’s what the fixed code looks like

static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb,
                                        struct net_device *netdev){
    // ... some code ...
    err = enic_queue_wq_skb(vdev, skb);
    if (err)
        goto unlock;   // <-- if error, skip code that uses skb
    skb_tx_timestamp(skb); // Only called if skb is still valid
    // ... more code ...
unlock:
    spin_unlock(...); // cleanup and return
    return tx_ret;
}

Original References

- linux kernel mailing list patch submission
- CVE Details entry
- Git commit fixing the bug (on kernel.org)

Update your Linux kernel: Make sure your system's kernel is patched against CVE-2021-46998.

- Check your distribution: All major distributions (RHEL, Ubuntu, etc.) have released security updates. See your vendor’s advisory.
- Not just servers: Cloud, virtual machines, and physical servers using Cisco ENIC adapters (common in cloud data centers) are affected.

In Summary

CVE-2021-46998 in the Linux ENIC driver is a use-after-free bug that makes kernel crashes or worse possible via network traffic. The patch ensures the kernel never accesses freed memory by tweaking the error handling logic. Keeping your kernel up-to-date will keep you protected.

If you want to dig deeper

- Linux Kernel ENIC Driver - official code
- CVE-2021-46998 - NIST listing

Timeline

Published on: 02/28/2024 09:15:38 UTC
Last modified on: 12/06/2024 14:56:48 UTC