CVE-2021-47563

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: avoid bpf_prog refcount underflow

Ice driver has the routines for managing XDP resources that are shared

between ndo_bpf op and VSI rebuild flow. The latter takes place for

example when user changes queue count on an interface via ethtool's

set_channels().

There is an issue around the bpf_prog refcounting when VSI is being

rebuilt - since ice_prepare_xdp_rings() is called with vsi->xdp_prog as

an argument that is used later on by ice_vsi_assign_bpf_prog(), same

bpf_prog pointers are swapped with each other. Then it is also

interpreted as an 'old_prog' which in turn causes us to call

bpf_prog_put on it that will decrement its refcount.

Below splat can be interpreted in a way that due to zero refcount of a

bpf_prog it is wiped out from the system while kernel still tries to

refer to it:

[ 481.069429] BUG: unable to handle page fault for address: ffffc9000640f038

[ 481.077390] #PF: supervisor read access in ke

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References