{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47183", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-25T09:12:14.112Z", "datePublished": "2024-04-10T18:56:24.383Z", "dateUpdated": "2026-08-05T08:46:32.666Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:32.666Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix link down processing to address NULL pointer dereference\n\nIf an FC link down transition while PLOGIs are outstanding to fabric well\nknown addresses, outstanding ABTS requests may result in a NULL pointer\ndereference. Driver unload requests may hang with repeated \"2878\" log\nmessages.\n\nThe Link down processing results in ABTS requests for outstanding ELS\nrequests. The Abort WQEs are sent for the ELSs before the driver had set\nthe link state to down. Thus the driver is sending the Abort with the\nexpectation that an ABTS will be sent on the wire. The Abort request is\nstalled waiting for the link to come up. In some conditions the driver may\nauto-complete the ELSs thus if the link does come up, the Abort completions\nmay reference an invalid structure.\n\nFix by ensuring that Abort set the flag to avoid link traffic if issued due\nto conditions where the link failed." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The bug is hit from SLI4 FC link-attention handling (lpfc_sli4_async_fc_evt → lpfc_els_flush_all_cmd) when the Emulex/Broadcom HBA reports link down on the FC/FCoE SAN; an adjacent fabric entity (switch port bounce/NOS-OLS, MDS link-down, or FCoE L2 peer) can induce that attention without Internet reachability.\nAC:L - An attacker who can flap the FC link during fabric discovery (when PLOGIs to fabric well-known addresses are outstanding) forces the deterministic flush-before-phba->link_state-update ordering bug; no attacker-uncontrollable memory layout is required.\nPR:N - Link-down ACQE processing and ELS abort issuance run in HBA/worker context with no host authentication, capability, or local account check; privileges on the SAN switch are not privileges on the vulnerable Linux host.\nUI:N - Fabric login/discovery PLOGIs and link-attention handling run automatically whenever the HBA is online on a fabric; no separate victim mount, click, or interactive action is required.\nS:U - The NULL/invalid IOCB reference and resulting kernel fault stay inside the host lpfc driver under the same OS authority; there is no VM escape, IOMMU/DMA bypass, or other cross-boundary impact.\nC:H - Abort completion after the driver auto-completes/frees the outstanding ELS IOCB yields use-after-free of the iocbq (via iotag lookup/completion paths); per guidance UAF enables reclaim-assisted arbitrary kernel read.\nI:H - The same freed IOCB/completion-callback reuse provides a heap UAF write/control-flow primitive (callable cmd_cmpl on reclaimed memory), so integrity impact is High rather than a pure clean crash.\nA:H - The invalid structure reference produces a kernel NULL deref/oops, and stalled ABORT_XRI exchanges also hang driver unload with repeated 2878 ELS XRI busy waits—full availability loss." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/scsi/lpfc/lpfc_sli.c" ], "versions": [ { "version": "70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf", "lessThan": "04c1af683270e4709a594bb1691b8800b945035a", "status": "affected", "versionType": "git" }, { "version": "70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf", "lessThan": "28de48a7cea495ab48082d9ff4ef63f7cb4e563a", "status": "affected", "versionType": "git" }, { "version": "70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf", "lessThan": "1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/scsi/lpfc/lpfc_sli.c" ], "versions": [ { "version": "2.6.38", "status": "affected" }, { "version": "0", "lessThan": "2.6.38", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.241", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.5", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.10.241" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.15.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/04c1af683270e4709a594bb1691b8800b945035a" }, { "url": "https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a" }, { "url": "https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6" } ], "title": "scsi: lpfc: Fix link down processing to address NULL pointer dereference", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:30:53.906Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-47183", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:50:17.652895Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:40.539Z" } } ] } }