CVE-2021-43975: Linux Kernel Buffer Overflow Vulnerability

CVE-2021-43975 Overview

CVE-2021-43975 is an out-of-bounds write vulnerability in the Linux kernel through version 5.15.2. The flaw resides in the hw_atl_utils_fw_rpc_wait function within drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c. An attacker with the ability to introduce a crafted device can trigger memory corruption by supplying a malicious length value. The vulnerability affects the Aquantia Atlantic Ethernet driver and impacts multiple Linux distributions including Debian, Fedora, and NetApp HCI firmware products. The weakness is classified under CWE-787 (Out-of-Bounds Write).

Critical Impact

Successful exploitation can lead to kernel memory corruption, enabling local privilege escalation, code execution in kernel context, or system crashes.

Affected Products

• Linux Kernel through 5.15.2
• Debian Linux 9.0 and 10.0; Fedora 34 and 35
• NetApp HCI Compute and Storage Nodes (H300E, H500E, H700E, H410C, H410S, H500S, H700S) and NetApp Cloud Backup

Discovery Timeline

• 2021-11-17 - CVE-2021-43975 published to NVD
• 2021-12-10 - NetApp publishes security advisory NTAP-20211210-0001
• 2022-02-01 - Debian releases security advisory DSA-5096
• 2022-03 - Debian LTS security announcement issued
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-43975

Vulnerability Analysis

The vulnerability exists in the Aquantia Atlantic 10 Gigabit Ethernet driver, specifically in the firmware Remote Procedure Call (RPC) handling code. The hw_atl_utils_fw_rpc_wait function fails to validate a length value supplied during firmware communication. When this length is processed, the kernel performs a write operation that exceeds the bounds of the destination buffer, corrupting adjacent kernel memory.

The attack surface requires local access and the ability to attach a crafted hardware device, such as a malicious USB or Thunderbolt peripheral that emulates the Aquantia adapter. This makes the vulnerability particularly relevant in environments where physical access to systems is possible, such as shared workstations, kiosks, or laptops.

Root Cause

The root cause is missing bounds validation on a length field received from a device during RPC firmware communication. The driver trusts attacker-controllable data and uses it directly to size or index a write operation. This is a textbook CWE-787 Out-of-Bounds Write condition in kernel space.

Attack Vector

An attacker introduces a crafted device that masquerades as an Aquantia Atlantic Ethernet adapter. When the kernel driver initializes and exchanges firmware RPC messages with the device, the device returns a maliciously crafted length value. The vulnerable code path then writes attacker-influenced data outside the intended buffer boundary, corrupting kernel structures. Refer to the Linux Kernel Commit Update for the exact code change that addresses the issue.

Detection Methods for CVE-2021-43975

Indicators of Compromise

• Unexpected kernel oops or panic messages referencing hw_atl_utils or the atlantic module in dmesg or /var/log/kern.log
• Insertion of unknown USB, Thunderbolt, or PCIe devices identifying as Aquantia network adapters in lspci or lsusb output
• Loading of the atlantic kernel module on systems that do not legitimately use Aquantia hardware

Detection Strategies

• Audit kernel module load events for the atlantic driver and correlate with hardware inventory baselines
• Monitor for hot-plug device events that introduce new network adapters outside change windows
• Review crash dumps and kernel ring buffer logs for out-of-bounds write signatures originating in the Atlantic driver stack

Monitoring Recommendations

• Enable kernel address sanitizer (KASAN) on test systems to surface memory corruption during driver fuzzing
• Aggregate Linux audit logs centrally and alert on KERNEL_MODULE_LOAD events for network drivers
• Track removable device telemetry through endpoint protection tooling to identify rogue peripherals

How to Mitigate CVE-2021-43975

Immediate Actions Required

• Apply the upstream Linux kernel patch referenced in the Linux Kernel Commit or upgrade to a fixed distribution kernel
• Update Debian systems per DSA-5096 and Fedora systems via the official package announcements
• Review NetApp HCI deployments against the NetApp Security Advisory NTAP-20211210-0001 and apply firmware updates

Patch Information

The upstream fix is committed to the netdev/net.git tree under commit hash b922f622592af76b57cbc566eaeccda0b31a3496. Distribution-specific patches are available through the Debian LTS Security Announcement, Fedora package announcements (X24M7KDC, YODMYMGZ), and the Kernel Netdev Patch Notification.

Workarounds

• Blacklist the atlantic kernel module on systems that do not require Aquantia hardware by adding blacklist atlantic to /etc/modprobe.d/blacklist.conf
• Restrict physical access to systems and disable hot-plug interfaces such as Thunderbolt and external PCIe where feasible
• Enforce USB and peripheral device control policies to prevent attachment of unauthorized network adapters

# Configuration example: blacklist the vulnerable driver
echo "blacklist atlantic" | sudo tee /etc/modprobe.d/blacklist-atlantic.conf
sudo update-initramfs -u
sudo reboot