CVE-2021-47548

The hns_dsaf_ge_srst_by_port() function checks whether the passed port parameter value is less than DSAF_GE_NUM (8), however the dsaf_dev->mac_cb array has a length of DSAF_MAX_PORT_NUM (6). When the port value is 6 or 7, the precondition does not block access, and the code accesses an array element outside its boundaries. The fix consists of adding an earlier check that terminates function execution if port is greater than or equal to DSAF_MAX_PORT_NUM (6).

An attacker can cause a write outside array boundaries in kernel space, potentially leading to arbitrary code execution (RCE), privilege escalation, or system destabilization.

Apply patches available from the manufacturer according to the references. Fixes have been published in the Linux kernel stable repository under the following commits: 22519eff7df2, 948968f8747650, 99bb25cb6753be, a66998e0fbf213, abbd5faa0748d0.

Linux Kernel — versions indicated in the manufacturer's references (HiSilicon HNS ethernet driver, hns_dsaf_misc component)