CVE-2021-47184 (GCVE-0-2021-47184)

Vulnerability from cvelistv5 – Published: 2024-04-10 18:56 – Updated: 2026-08-05 08:46
VLAI
Title
i40e: Fix NULL ptr dereference on VSI filter sync
Summary
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL ptr dereference on VSI filter sync Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to sync this thread with sync filters subtask. Without this patch it is possible to start update the VSI filter list after VSI is removed, that's causing a kernel oops.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 41c445ff0f482bb6e6b72dcee9e598e20575f743 , < 78f2a9e831f9610e3655a0be5e675e1aa2472089 (git)
Affected: 41c445ff0f482bb6e6b72dcee9e598e20575f743 , < 87c421ab4a43433cb009fea44bbbc77f46913e1d (git)
Affected: 41c445ff0f482bb6e6b72dcee9e598e20575f743 , < c30162da91327e4cdf7cd03079f096bb3654738c (git)
Affected: 41c445ff0f482bb6e6b72dcee9e598e20575f743 , < f866513ead4370402428ef724b03c3312295c178 (git)
Affected: 41c445ff0f482bb6e6b72dcee9e598e20575f743 , < e91e8427a1e1633a0261e3bb0201c836ac5b3890 (git)
Affected: 41c445ff0f482bb6e6b72dcee9e598e20575f743 , < 37d9e304acd903a445df8208b8a13d707902dea6 (git)
Create a notification for this product.
Linux Linux Affected: 3.12
Unaffected: 0 , < 3.12 (semver)
Unaffected: 4.14.256 , ≤ 4.14.* (semver)
Unaffected: 4.19.218 , ≤ 4.19.* (semver)
Unaffected: 5.4.162 , ≤ 5.4.* (semver)
Unaffected: 5.10.82 , ≤ 5.10.* (semver)
Unaffected: 5.15.5 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47184",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T19:33:14.911867Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:13:59.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.468Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e.h",
            "drivers/net/ethernet/intel/i40e/i40e_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78f2a9e831f9610e3655a0be5e675e1aa2472089",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            },
            {
              "lessThan": "87c421ab4a43433cb009fea44bbbc77f46913e1d",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            },
            {
              "lessThan": "c30162da91327e4cdf7cd03079f096bb3654738c",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            },
            {
              "lessThan": "f866513ead4370402428ef724b03c3312295c178",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            },
            {
              "lessThan": "e91e8427a1e1633a0261e3bb0201c836ac5b3890",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            },
            {
              "lessThan": "37d9e304acd903a445df8208b8a13d707902dea6",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e.h",
            "drivers/net/ethernet/intel/i40e/i40e_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.256",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.218",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.162",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.82",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix NULL ptr dereference on VSI filter sync\n\nRemove the reason of null pointer dereference in sync VSI filters.\nAdded new I40E_VSI_RELEASING flag to signalize deleting and releasing\nof VSI resources to sync this thread with sync filters subtask.\nWithout this patch it is possible to start update the VSI filter list\nafter VSI is removed, that\u0027s causing a kernel oops."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the host i40e PF driver and is reached via the SR-IOV VF virtchnl/mailbox path (MAC filter updates and VIRTCHNL_OP_RESET_VF/VFLR \u2192 i40e_vsi_release racing i40e_sync_filters_subtask), which requires local access to an assigned VF rather than remote packet processing.\nAC:L - A VF attacker controls both sides of the race by programming MAC filters (FILTER_CHANGED / MACVLAN_SYNC_PENDING) and then inducing VF reset/VFLR so the service task syncs while i40e_vsi_release frees the VSI; success does not depend on conditions outside attacker control.\nPR:L - Exploitation needs only guest/tenant control of an assigned VF (iavf virtchnl ops or VFLR), not real host root or init-namespace CAP_NET_ADMIN to write sriov_numvfs or unbind the PF.\nUI:N - The attacker alone drives filter updates and VF reset/VFLR; no separate victim action is required.\nS:C - A malicious VF guest triggers host-PF use-after-free/NULL dereference and host oops, denying availability of the host and co-tenants beyond the guest\u2019s security authority (guest-to-host impact).\nC:H - The service-task sync can wait on __I40E_VSI_SYNCING_FILTERS then resume after i40e_vsi_clear kfree\u2019s the VSI, yielding a heap UAF of the VSI object that per guidance enables reclaim-assisted arbitrary read.\nI:H - The same UAF of the VSI during concurrent filter sync versus release is heap-groomable into write/control-flow hijack primitives, so integrity impact is High rather than a pure crash-only NULL deref.\nA:H - The documented failure is a host kernel oops from syncing filters after VSI removal, and any UAF is scored High availability impact even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:33.774Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089"
        },
        {
          "url": "https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178"
        },
        {
          "url": "https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890"
        },
        {
          "url": "https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6"
        }
      ],
      "title": "i40e: Fix NULL ptr dereference on VSI filter sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47184",
    "datePublished": "2024-04-10T18:56:25.037Z",
    "dateReserved": "2024-03-25T09:12:14.112Z",
    "dateUpdated": "2026-08-05T08:46:33.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47184",
      "date": "2026-08-10",
      "epss": "0.00248",
      "percentile": "0.16089"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni40e: Fix NULL ptr dereference on VSI filter sync\\n\\nRemove the reason of null pointer dereference in sync VSI filters.\\nAdded new I40E_VSI_RELEASING flag to signalize deleting and releasing\\nof VSI resources to sync this thread with sync filters subtask.\\nWithout this patch it is possible to start update the VSI filter list\\nafter VSI is removed, that\u0027s causing a kernel oops.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i40e: Corregir la desreferencia de puntero nulo en la sincronizaci\\u00f3n de filtros VSI Eliminar el motivo de la desreferencia de puntero nulo en los filtros VSI de sincronizaci\\u00f3n. Se ha a\\u00f1adido el nuevo indicador I40E_VSI_RELEASING para se\\u00f1alar la eliminaci\\u00f3n y liberaci\\u00f3n de recursos VSI para sincronizar este hilo con la subtarea de filtros de sincronizaci\\u00f3n. Sin este parche, es posible comenzar a actualizar la lista de filtros VSI despu\\u00e9s de que se elimine VSI, lo que provoca un error en el kernel.\"}]",
      "id": "CVE-2021-47184",
      "lastModified": "2024-11-21T06:35:34.670",
      "published": "2024-04-10T19:15:47.333",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47184\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-10T19:15:47.333\",\"lastModified\":\"2026-08-04T10:16:51.017\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni40e: Fix NULL ptr dereference on VSI filter sync\\n\\nRemove the reason of null pointer dereference in sync VSI filters.\\nAdded new I40E_VSI_RELEASING flag to signalize deleting and releasing\\nof VSI resources to sync this thread with sync filters subtask.\\nWithout this patch it is possible to start update the VSI filter list\\nafter VSI is removed, that\u0027s causing a kernel oops.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i40e: Corregir la desreferencia de puntero nulo en la sincronizaci\u00f3n de filtros VSI Eliminar el motivo de la desreferencia de puntero nulo en los filtros VSI de sincronizaci\u00f3n. Se ha a\u00f1adido el nuevo indicador I40E_VSI_RELEASING para se\u00f1alar la eliminaci\u00f3n y liberaci\u00f3n de recursos VSI para sincronizar este hilo con la subtarea de filtros de sincronizaci\u00f3n. Sin este parche, es posible comenzar a actualizar la lista de filtros VSI despu\u00e9s de que se elimine VSI, lo que provoca un error en el kernel.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/i40e/i40e.h\",\"drivers/net/ethernet/intel/i40e/i40e_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"41c445ff0f482bb6e6b72dcee9e598e20575f743\",\"lessThan\":\"78f2a9e831f9610e3655a0be5e675e1aa2472089\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41c445ff0f482bb6e6b72dcee9e598e20575f743\",\"lessThan\":\"87c421ab4a43433cb009fea44bbbc77f46913e1d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41c445ff0f482bb6e6b72dcee9e598e20575f743\",\"lessThan\":\"c30162da91327e4cdf7cd03079f096bb3654738c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41c445ff0f482bb6e6b72dcee9e598e20575f743\",\"lessThan\":\"f866513ead4370402428ef724b03c3312295c178\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41c445ff0f482bb6e6b72dcee9e598e20575f743\",\"lessThan\":\"e91e8427a1e1633a0261e3bb0201c836ac5b3890\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41c445ff0f482bb6e6b72dcee9e598e20575f743\",\"lessThan\":\"37d9e304acd903a445df8208b8a13d707902dea6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/i40e/i40e.h\",\"drivers/net/ethernet/intel/i40e/i40e_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.256\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.218\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.162\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.82\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.5\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-10T19:33:14.911867Z\",\"id\":\"CVE-2021-47184\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.12\",\"versionEndExcluding\":\"4.14.256\",\"matchCriteriaId\":\"41062222-AC0B-4048-99F9-23789C1574E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.218\",\"matchCriteriaId\":\"4F85F433-5DEA-47D3-B07E-3B1AC474D6E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.162\",\"matchCriteriaId\":\"51A152D8-D5CE-47BD-9041-DEE164DCE99D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.82\",\"matchCriteriaId\":\"AE501832-500C-4EF1-9489-5C13674F619D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.5\",\"matchCriteriaId\":\"2128A085-4C0C-4C1E-9E9C-0DD868E2170F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:06:03+00:00",
      "cve": "CVE-2021-47184",
      "id": "CVE-2021-47184",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "44",
      "product_status:known_not_affected": "154",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: i40e: Fix NULL ptr dereference on VSI filter sync",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47184.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T02:07:49Z",
      "cve": "CVE-2021-47184",
      "id": "CVE-2021-47184",
      "initial_release_date": "2024-04-12T02:21:03Z",
      "product_status:known_affected": "293",
      "product_status:known_not_affected": "124",
      "product_status:recommended": "681",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47184",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47184.json",
      "version": "51"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.468Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47184\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-10T19:33:14.911867Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:23.018Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"i40e: Fix NULL ptr dereference on VSI filter sync\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in the host i40e PF driver and is reached via the SR-IOV VF virtchnl/mailbox path (MAC filter updates and VIRTCHNL_OP_RESET_VF/VFLR \\u2192 i40e_vsi_release racing i40e_sync_filters_subtask), which requires local access to an assigned VF rather than remote packet processing.\\nAC:L - A VF attacker controls both sides of the race by programming MAC filters (FILTER_CHANGED / MACVLAN_SYNC_PENDING) and then inducing VF reset/VFLR so the service task syncs while i40e_vsi_release frees the VSI; success does not depend on conditions outside attacker control.\\nPR:L - Exploitation needs only guest/tenant control of an assigned VF (iavf virtchnl ops or VFLR), not real host root or init-namespace CAP_NET_ADMIN to write sriov_numvfs or unbind the PF.\\nUI:N - The attacker alone drives filter updates and VF reset/VFLR; no separate victim action is required.\\nS:C - A malicious VF guest triggers host-PF use-after-free/NULL dereference and host oops, denying availability of the host and co-tenants beyond the guest\\u2019s security authority (guest-to-host impact).\\nC:H - The service-task sync can wait on __I40E_VSI_SYNCING_FILTERS then resume after i40e_vsi_clear kfree\\u2019s the VSI, yielding a heap UAF of the VSI object that per guidance enables reclaim-assisted arbitrary read.\\nI:H - The same UAF of the VSI during concurrent filter sync versus release is heap-groomable into write/control-flow hijack primitives, so integrity impact is High rather than a pure crash-only NULL deref.\\nA:H - The documented failure is a host kernel oops from syncing filters after VSI removal, and any UAF is scored High availability impact even when not fully exploited.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"78f2a9e831f9610e3655a0be5e675e1aa2472089\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"87c421ab4a43433cb009fea44bbbc77f46913e1d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"c30162da91327e4cdf7cd03079f096bb3654738c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"f866513ead4370402428ef724b03c3312295c178\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"e91e8427a1e1633a0261e3bb0201c836ac5b3890\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"37d9e304acd903a445df8208b8a13d707902dea6\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/i40e/i40e.h\", \"drivers/net/ethernet/intel/i40e/i40e_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.256\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.218\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.82\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/i40e/i40e.h\", \"drivers/net/ethernet/intel/i40e/i40e_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089\"}, {\"url\": \"https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d\"}, {\"url\": \"https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c\"}, {\"url\": \"https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178\"}, {\"url\": \"https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890\"}, {\"url\": \"https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni40e: Fix NULL ptr dereference on VSI filter sync\\n\\nRemove the reason of null pointer dereference in sync VSI filters.\\nAdded new I40E_VSI_RELEASING flag to signalize deleting and releasing\\nof VSI resources to sync this thread with sync filters subtask.\\nWithout this patch it is possible to start update the VSI filter list\\nafter VSI is removed, that\u0027s causing a kernel oops.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.256\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.218\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.162\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.82\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.5\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"3.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:33.774Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47184\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:33.774Z\", \"dateReserved\": \"2024-03-25T09:12:14.112Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-10T18:56:25.037Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.