CVE-2021-47031 - Memory Leak in Linux Kernel's mt76 Wi-Fi Driver (mt7921_coredump

The Linux kernel is the backbone of countless devices, from smartphones and laptops to servers and embedded systems. To ensure smooth wireless networking, it includes several device drivers. One such popular driver is mt76, which supports many Mediatek wireless chips. In 2021, a vulnerability with the identifier CVE-2021-47031 was discovered and patched in the mt76 driver, specifically affecting the mt7921 chipset. This vulnerability involved a memory leak in the function mt7921_coredump_work, which could over time impact system stability.

Let's break down what happened, understand how the bug worked, see the patch, and discuss exploitability—using simple terms for easier understanding.

What is CVE-2021-47031?

CVE-2021-47031 is assigned to a memory leak in the mt7921_coredump_work function, part of the Mediatek mt76 Wi-Fi driver in the Linux kernel.

Affected Component: Linux kernel mt76 driver (mt7921 chipset support)

- Source File: drivers/net/wireless/mediatek/mt76/mt7921

Introduced in: Support for the new mt7921 devices

- Fixed in: After Linux kernel commit 6c92e2b08be6

What is mt7921_coredump_work?

This is a worker function that handles the process of capturing and saving core dumps from the Wi-Fi device. A *core dump* is essentially a snapshot of device memory, useful for diagnosing crashes and bugs.

How did the Vulnerability Work?

When the mt7921_coredump_work routine got triggered (for example, due to a Wi-Fi chip crash), it allocated a buffer in memory to process the core dump. However, if the data didn't meet certain conditions, the allocated memory was not freed, leading to a memory leak.

Over time, especially if Wi-Fi device problems were frequent, the system would slowly run out of memory, resulting in degraded performance and possible crashes.

Here’s a simplified version of the buggy code that illustrates the issue

/* Vulnerable code snippet */
static void mt7921_coredump_work(struct work_struct *work)
{
    struct mt7921_dev *dev = ...;
    u8 *data;

    data = kmalloc(size, GFP_KERNEL);
    if (!data)
        return;      // Early exit, safe

    // ...do something, call a function...
    if (<some error condition>)
        return;      // Memory leak! data is never freed

    // ...more processing...

    kfree(data);      // Free memory when done
}

In this code, if the error condition occurs, the function returns early—but the memory pointer data is never freed!

The Patch and How It Fixes the Issue

The fix is straightforward: free the memory in all possible exit paths so that there's no leak even in case of errors.

Patched Code Example

static void mt7921_coredump_work(struct work_struct *work)
{
    struct mt7921_dev *dev = ...;
    u8 *data;

    data = kmalloc(size, GFP_KERNEL);
    if (!data)
        return;

    if (<some error condition>) {
        kfree(data);     // Free memory before returning!
        return;
    }

    // ...more processing...

    kfree(data);      // Free memory when done
}

So, if an error is detected, the function first frees the memory (kfree(data);) before returning.

References

- Commit with the fix (kernel.org)
- CVE-2021-47031 at cve.org

Can Attackers Exploit This Bug?

In simple terms: It's highly unlikely for an attacker to actively exploit this bug for code execution or privilege escalation. However, there is a possible denial-of-service risk.

- Who is affected? Users running the Linux kernel with the mt76 driver for MT7921 (like Lenovo AMD ThinkPads and others shipping the new Mediatek Wi-Fi chip).
- What could happen? If a malicious or buggy Wi-Fi environment causes repeated device core dumps, the kernel will leak memory each time. Over time, system resources are drained. The system could become slow or even crash (denial of service).

Proof of Concept: Triggering the Leak

Below is a simplified demonstration (for educational purposes) of how a script could monitor kernel memory usage and *simulate* repeated triggering of coredump work (though in reality, you would need to crash the Wi-Fi device, not feasible from a script).

# Monitor kernel slab usage for leaks:
watch "cat /proc/slabinfo | grep kmalloc"

Then, if something causes repeated Wi-Fi device "crashes" (like buggy firmware, fuzzing, or deliberate power cycling), you should see kernel memory slowly increase.

There is no straightforward remote or privilege escalation exploit—but this kind of bug is still important because kernel memory leaks are cumulative and can bring down the system over time.

How to Stay Safe

1. Check your kernel version: If you use the Mediatek MT7921 Wi-Fi chip *and* the mt76 driver, make sure your kernel includes the fix (May 2021 or later).
2. Update your Linux distro: Most distributions have backported the patch; check your vendor's official security advisories.

Conclusion

CVE-2021-47031 is a great example of how even small errors—like forgetting to free memory under certain conditions—can have big impacts on system reliability. While not very likely to be turned into an attack, it’s a classic resource management bug that demonstrates the importance of careful systems programming.

The fix is live in all modern Linux kernels. If you maintain Linux devices using Mediatek Wi-Fi chips (especially laptops), make sure your updates include this patch!

Timeline

Published on: 02/28/2024 09:15:39 UTC
Last modified on: 11/13/2024 22:35:02 UTC

CVE-2021-47031 - Memory Leak in Linux Kernel's mt76 Wi-Fi Driver (mt7921_coredump_work)