CVE-2021-47592 is a medium-severity vulnerability in the Linux kernel's stmmac network driver, specifically related to the handling of traffic control (tc) flower filters for VLAN priority-based receive (Rx) frame steering. The vulnerability arises from a NULL pointer dereference triggered when deleting a tc flower filter configured for VLAN priority Rx steering. The root cause is an incorrect implementation in the tc_del_vlan_flow() function, which attempts to retrieve a flow_rule pointer via flow_cls_offload_flow_rule(cls) that is no longer valid during filter deletion. This leads to a kernel NULL pointer dereference and consequent kernel oops, causing a denial of service (DoS) by crashing the kernel. The issue manifests when a user adds a flower filter for VLAN priority frame steering on an Ethernet device, then deletes a specific tc flower record, resulting in a kernel crash observable in dmesg logs. The patch introduces a driver-side flow_cls_offload record (stmmac_rfs_entry) to correctly track and delete VLAN classification records associated with hardware traffic classes (hw_tc), preventing invalid pointer dereferences. This fix also lays groundwork for future extensions to support other Rx frame steering types such as EtherType-based filtering. The vulnerability requires local privileges with the ability to configure tc filters on the affected network interface and does not require user interaction. The CVSS v3.1 score is 5.5 (medium), reflecting local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability due to kernel crashes. No known exploits are reported in the wild as of publication.

For European organizations, this vulnerability poses a risk primarily to systems running vulnerable Linux kernel versions with the stmmac driver enabled and using VLAN priority Rx steering via tc flower filters. The impact is a denial of service through kernel crashes, which can disrupt network connectivity and availability of critical services relying on affected Linux hosts or network appliances. This is particularly relevant for organizations with infrastructure using embedded Linux devices, industrial control systems, or network equipment employing the stmmac driver for Ethernet interfaces. The vulnerability does not expose data confidentiality or integrity but can cause service outages, potentially affecting operational continuity. In sectors such as telecommunications, manufacturing, and critical infrastructure, where Linux-based network devices are common, this could lead to significant operational disruptions. However, exploitation requires local privileges to configure tc filters, limiting remote exploitation risk. The absence of known exploits reduces immediate threat but patching remains important to prevent potential DoS attacks by malicious insiders or compromised local users.

European organizations should take the following specific mitigation steps: 1) Identify Linux systems using the stmmac driver and verify kernel versions against the patched versions addressing CVE-2021-47592. 2) Apply the official Linux kernel patches or upgrade to a kernel version that includes the fix to prevent NULL pointer dereference during tc flower filter deletion. 3) Restrict local user privileges to prevent unauthorized configuration of tc filters, limiting the ability to trigger the vulnerability. 4) Monitor system logs (dmesg) for kernel oops or crashes related to tc flower filter operations as indicators of attempted exploitation or misconfiguration. 5) For embedded or specialized devices where kernel upgrades are challenging, consider disabling VLAN priority Rx steering or tc flower filters if not required. 6) Incorporate this vulnerability into vulnerability management and patching cycles, prioritizing systems critical to network operations and industrial control. 7) Educate system administrators on safe usage of tc filters and the risks of improper deletion commands. These measures go beyond generic advice by focusing on driver-specific configurations, privilege restrictions, and operational monitoring tailored to this vulnerability.