{
  "cveId": "CVE-2021-47479",
  "url": "https://patchblox.com/security/cve/CVE-2021-47479",
  "summary": "CVE-2021-47479 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47479, released May 22, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  staging: rtl8712: fix use-after-free in rtl8712_...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  staging: rtl8712: fix use-after-free in rtl8712_dl_fw  Syzbot reported use-after-free in rtl8712_dl_fw(). The problem was in race condition between r871xu_dev_remove() -\u003Endo_open() callback.  It\u0027s easy to see from crash log, that driver accesses released firmware in -\u003Endo_open() callback. It may happen, since driver was releasing firmware _before_ unregistering netdev. Fix it by moving unregister_netdev() before cleaning up resources.  Call Trace: ...  rtl871x_open_fw drivers/staging/rtl8712/hal_init.c:83 [inline]  rtl8712_dl_fw\u002B0xd95/0xe10 drivers/staging/rtl8712/hal_init.c:170  rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]  rtl871x_hal_init\u002B0xae/0x180 drivers/staging/rtl8712/hal_init.c:394  netdev_open\u002B0xe6/0x6c0 drivers/staging/rtl8712/os_intfs.c:380  __dev_open\u002B0x2bc/0x4d0 net/core/dev.c:1484  Freed by task 1306: ...  release_firmware\u002B0x1b/0x30 drivers/base/firmware_loader/main.c:1053  r871xu_dev_remove\u002B0xcc/0x2c0 drivers/staging/rtl8712/usb_intf.c:599  usb_unbind_interface\u002B0x1d8/0x8d0 drivers/usb/core/driver.c:458",
  "published": "2024-05-22T09:15:09Z",
  "severity": "high",
  "cvss": 7,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00228,
  "epssPercentile": 0.13594,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.15.3-1",
      "fix": "DEBIAN-CVE-2021-47479",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47479",
      "released": "2024-05-22T09:15:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.15.3-1",
      "fix": "DEBIAN-CVE-2021-47479",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47479",
      "released": "2024-05-22T09:15:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.15.3-1",
      "fix": "DEBIAN-CVE-2021-47479",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47479",
      "released": "2024-05-22T09:15:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}