GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47183 (GCVE-0-2021-47183)

Vulnerability from cvelistv5 – Published: 2024-04-10 18:56 – Updated: 2026-08-05 08:46
VLAI
Title
scsi: lpfc: Fix link down processing to address NULL pointer dereference
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix link down processing to address NULL pointer dereference If an FC link down transition while PLOGIs are outstanding to fabric well known addresses, outstanding ABTS requests may result in a NULL pointer dereference. Driver unload requests may hang with repeated "2878" log messages. The Link down processing results in ABTS requests for outstanding ELS requests. The Abort WQEs are sent for the ELSs before the driver had set the link state to down. Thus the driver is sending the Abort with the expectation that an ABTS will be sent on the wire. The Abort request is stalled waiting for the link to come up. In some conditions the driver may auto-complete the ELSs thus if the link does come up, the Abort completions may reference an invalid structure. Fix by ensuring that Abort set the flag to avoid link traffic if issued due to conditions where the link failed.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:50 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf , < 04c1af683270e4709a594bb1691b8800b945035a (git)
Affected: 70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf , < 28de48a7cea495ab48082d9ff4ef63f7cb4e563a (git)
Affected: 70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf , < 1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.38
Unaffected: 0 , < 2.6.38 (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.5 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:30:53.906Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47183",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:50:17.652895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:40.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/lpfc/lpfc_sli.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "04c1af683270e4709a594bb1691b8800b945035a",
              "status": "affected",
              "version": "70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf",
              "versionType": "git"
            },
            {
              "lessThan": "28de48a7cea495ab48082d9ff4ef63f7cb4e563a",
              "status": "affected",
              "version": "70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf",
              "versionType": "git"
            },
            {
              "lessThan": "1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6",
              "status": "affected",
              "version": "70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/lpfc/lpfc_sli.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix link down processing to address NULL pointer dereference\n\nIf an FC link down transition while PLOGIs are outstanding to fabric well\nknown addresses, outstanding ABTS requests may result in a NULL pointer\ndereference. Driver unload requests may hang with repeated \"2878\" log\nmessages.\n\nThe Link down processing results in ABTS requests for outstanding ELS\nrequests. The Abort WQEs are sent for the ELSs before the driver had set\nthe link state to down. Thus the driver is sending the Abort with the\nexpectation that an ABTS will be sent on the wire. The Abort request is\nstalled waiting for the link to come up. In some conditions the driver may\nauto-complete the ELSs thus if the link does come up, the Abort completions\nmay reference an invalid structure.\n\nFix by ensuring that Abort set the flag to avoid link traffic if issued due\nto conditions where the link failed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is hit from SLI4 FC link-attention handling (lpfc_sli4_async_fc_evt \u2192 lpfc_els_flush_all_cmd) when the Emulex/Broadcom HBA reports link down on the FC/FCoE SAN; an adjacent fabric entity (switch port bounce/NOS-OLS, MDS link-down, or FCoE L2 peer) can induce that attention without Internet reachability.\nAC:L - An attacker who can flap the FC link during fabric discovery (when PLOGIs to fabric well-known addresses are outstanding) forces the deterministic flush-before-phba-\u003elink_state-update ordering bug; no attacker-uncontrollable memory layout is required.\nPR:N - Link-down ACQE processing and ELS abort issuance run in HBA/worker context with no host authentication, capability, or local account check; privileges on the SAN switch are not privileges on the vulnerable Linux host.\nUI:N - Fabric login/discovery PLOGIs and link-attention handling run automatically whenever the HBA is online on a fabric; no separate victim mount, click, or interactive action is required.\nS:U - The NULL/invalid IOCB reference and resulting kernel fault stay inside the host lpfc driver under the same OS authority; there is no VM escape, IOMMU/DMA bypass, or other cross-boundary impact.\nC:H - Abort completion after the driver auto-completes/frees the outstanding ELS IOCB yields use-after-free of the iocbq (via iotag lookup/completion paths); per guidance UAF enables reclaim-assisted arbitrary kernel read.\nI:H - The same freed IOCB/completion-callback reuse provides a heap UAF write/control-flow primitive (callable cmd_cmpl on reclaimed memory), so integrity impact is High rather than a pure clean crash.\nA:H - The invalid structure reference produces a kernel NULL deref/oops, and stalled ABORT_XRI exchanges also hang driver unload with repeated 2878 ELS XRI busy waits\u2014full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:32.666Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/04c1af683270e4709a594bb1691b8800b945035a"
        },
        {
          "url": "https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6"
        }
      ],
      "title": "scsi: lpfc: Fix link down processing to address NULL pointer dereference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47183",
    "datePublished": "2024-04-10T18:56:24.383Z",
    "dateReserved": "2024-03-25T09:12:14.112Z",
    "dateUpdated": "2026-08-05T08:46:32.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47183",
      "date": "2026-09-15",
      "epss": "0.00332",
      "percentile": "0.26269"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: lpfc: Fix link down processing to address NULL pointer dereference\\n\\nIf an FC link down transition while PLOGIs are outstanding to fabric well\\nknown addresses, outstanding ABTS requests may result in a NULL pointer\\ndereference. Driver unload requests may hang with repeated \\\"2878\\\" log\\nmessages.\\n\\nThe Link down processing results in ABTS requests for outstanding ELS\\nrequests. The Abort WQEs are sent for the ELSs before the driver had set\\nthe link state to down. Thus the driver is sending the Abort with the\\nexpectation that an ABTS will be sent on the wire. The Abort request is\\nstalled waiting for the link to come up. In some conditions the driver may\\nauto-complete the ELSs thus if the link does come up, the Abort completions\\nmay reference an invalid structure.\\n\\nFix by ensuring that Abort set the flag to avoid link traffic if issued due\\nto conditions where the link failed.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: Se soluciona el procesamiento de enlace inactivo para abordar la desreferencia de puntero NULL Si una transici\\u00f3n de enlace inactivo FC mientras hay PLOGI pendientes para direcciones conocidas de Fabric, las solicitudes ABTS pendientes pueden resultar en una desreferencia de puntero NULL. Las solicitudes de descarga del controlador pueden bloquearse con mensajes de registro \\\"2878\\\" repetidos. El procesamiento de enlace inactivo da como resultado solicitudes ABTS para solicitudes ELS pendientes. Los WQE de cancelaci\\u00f3n se env\\u00edan para los ELS antes de que el controlador haya establecido el estado del enlace en inactivo. Por lo tanto, el controlador env\\u00eda la cancelaci\\u00f3n con la expectativa de que se env\\u00ede una ABTS en el cable. La solicitud de cancelaci\\u00f3n se detiene esperando que se active el enlace. En algunas condiciones, el controlador puede completar autom\\u00e1ticamente los ELS, por lo que si el enlace se activa, las finalizaciones de cancelaci\\u00f3n pueden hacer referencia a una estructura no v\\u00e1lida. Se soluciona asegur\\u00e1ndose de que la cancelaci\\u00f3n establezca el indicador para evitar el tr\\u00e1fico de enlace si se emite debido a condiciones en las que el enlace fall\\u00f3.\"}]",
      "id": "CVE-2021-47183",
      "lastModified": "2024-11-21T06:35:34.553",
      "published": "2024-04-10T19:15:47.287",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47183\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-10T19:15:47.287\",\"lastModified\":\"2026-08-04T10:16:50.850\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: lpfc: Fix link down processing to address NULL pointer dereference\\n\\nIf an FC link down transition while PLOGIs are outstanding to fabric well\\nknown addresses, outstanding ABTS requests may result in a NULL pointer\\ndereference. Driver unload requests may hang with repeated \\\"2878\\\" log\\nmessages.\\n\\nThe Link down processing results in ABTS requests for outstanding ELS\\nrequests. The Abort WQEs are sent for the ELSs before the driver had set\\nthe link state to down. Thus the driver is sending the Abort with the\\nexpectation that an ABTS will be sent on the wire. The Abort request is\\nstalled waiting for the link to come up. In some conditions the driver may\\nauto-complete the ELSs thus if the link does come up, the Abort completions\\nmay reference an invalid structure.\\n\\nFix by ensuring that Abort set the flag to avoid link traffic if issued due\\nto conditions where the link failed.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: Se soluciona el procesamiento de enlace inactivo para abordar la desreferencia de puntero NULL Si una transici\u00f3n de enlace inactivo FC mientras hay PLOGI pendientes para direcciones conocidas de Fabric, las solicitudes ABTS pendientes pueden resultar en una desreferencia de puntero NULL. Las solicitudes de descarga del controlador pueden bloquearse con mensajes de registro \\\"2878\\\" repetidos. El procesamiento de enlace inactivo da como resultado solicitudes ABTS para solicitudes ELS pendientes. Los WQE de cancelaci\u00f3n se env\u00edan para los ELS antes de que el controlador haya establecido el estado del enlace en inactivo. Por lo tanto, el controlador env\u00eda la cancelaci\u00f3n con la expectativa de que se env\u00ede una ABTS en el cable. La solicitud de cancelaci\u00f3n se detiene esperando que se active el enlace. En algunas condiciones, el controlador puede completar autom\u00e1ticamente los ELS, por lo que si el enlace se activa, las finalizaciones de cancelaci\u00f3n pueden hacer referencia a una estructura no v\u00e1lida. Se soluciona asegur\u00e1ndose de que la cancelaci\u00f3n establezca el indicador para evitar el tr\u00e1fico de enlace si se emite debido a condiciones en las que el enlace fall\u00f3.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/lpfc/lpfc_sli.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf\",\"lessThan\":\"04c1af683270e4709a594bb1691b8800b945035a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf\",\"lessThan\":\"28de48a7cea495ab48082d9ff4ef63f7cb4e563a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf\",\"lessThan\":\"1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/lpfc/lpfc_sli.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.38\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.38\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.241\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.5\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:50:17.652895Z\",\"id\":\"CVE-2021-47183\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.15.5\",\"matchCriteriaId\":\"B2845F69-264B-45BD-B7E7-D12B24338382\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04c1af683270e4709a594bb1691b8800b945035a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-10T13:00:12+00:00",
      "cve": "CVE-2021-47183",
      "id": "CVE-2021-47183",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "99",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: lpfc: Fix link down processing to address NULL pointer dereference",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47183.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:19:23Z",
      "cve": "CVE-2021-47183",
      "id": "CVE-2021-47183",
      "initial_release_date": "2024-04-12T02:21:04Z",
      "product_status:known_affected": "408",
      "product_status:known_not_affected": "106",
      "product_status:recommended": "585",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47183",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47183.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T17:30:53.906Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47183\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:50:17.652895Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:18.053Z\"}}], \"cna\": {\"title\": \"scsi: lpfc: Fix link down processing to address NULL pointer dereference\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The bug is hit from SLI4 FC link-attention handling (lpfc_sli4_async_fc_evt \\u2192 lpfc_els_flush_all_cmd) when the Emulex/Broadcom HBA reports link down on the FC/FCoE SAN; an adjacent fabric entity (switch port bounce/NOS-OLS, MDS link-down, or FCoE L2 peer) can induce that attention without Internet reachability.\\nAC:L - An attacker who can flap the FC link during fabric discovery (when PLOGIs to fabric well-known addresses are outstanding) forces the deterministic flush-before-phba-\u003elink_state-update ordering bug; no attacker-uncontrollable memory layout is required.\\nPR:N - Link-down ACQE processing and ELS abort issuance run in HBA/worker context with no host authentication, capability, or local account check; privileges on the SAN switch are not privileges on the vulnerable Linux host.\\nUI:N - Fabric login/discovery PLOGIs and link-attention handling run automatically whenever the HBA is online on a fabric; no separate victim mount, click, or interactive action is required.\\nS:U - The NULL/invalid IOCB reference and resulting kernel fault stay inside the host lpfc driver under the same OS authority; there is no VM escape, IOMMU/DMA bypass, or other cross-boundary impact.\\nC:H - Abort completion after the driver auto-completes/frees the outstanding ELS IOCB yields use-after-free of the iocbq (via iotag lookup/completion paths); per guidance UAF enables reclaim-assisted arbitrary kernel read.\\nI:H - The same freed IOCB/completion-callback reuse provides a heap UAF write/control-flow primitive (callable cmd_cmpl on reclaimed memory), so integrity impact is High rather than a pure clean crash.\\nA:H - The invalid structure reference produces a kernel NULL deref/oops, and stalled ABORT_XRI exchanges also hang driver unload with repeated 2878 ELS XRI busy waits\\u2014full availability loss.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf\", \"lessThan\": \"04c1af683270e4709a594bb1691b8800b945035a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf\", \"lessThan\": \"28de48a7cea495ab48082d9ff4ef63f7cb4e563a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"70f3c073362ef7b5e55c92b83eb2dd9a7fb4e9bf\", \"lessThan\": \"1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/scsi/lpfc/lpfc_sli.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.38\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.38\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.241\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/scsi/lpfc/lpfc_sli.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/04c1af683270e4709a594bb1691b8800b945035a\"}, {\"url\": \"https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a\"}, {\"url\": \"https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: lpfc: Fix link down processing to address NULL pointer dereference\\n\\nIf an FC link down transition while PLOGIs are outstanding to fabric well\\nknown addresses, outstanding ABTS requests may result in a NULL pointer\\ndereference. Driver unload requests may hang with repeated \\\"2878\\\" log\\nmessages.\\n\\nThe Link down processing results in ABTS requests for outstanding ELS\\nrequests. The Abort WQEs are sent for the ELSs before the driver had set\\nthe link state to down. Thus the driver is sending the Abort with the\\nexpectation that an ABTS will be sent on the wire. The Abort request is\\nstalled waiting for the link to come up. In some conditions the driver may\\nauto-complete the ELSs thus if the link does come up, the Abort completions\\nmay reference an invalid structure.\\n\\nFix by ensuring that Abort set the flag to avoid link traffic if issued due\\nto conditions where the link failed.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.241\", \"versionStartIncluding\": \"2.6.38\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.5\", \"versionStartIncluding\": \"2.6.38\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"2.6.38\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:32.666Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47183\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:32.666Z\", \"dateReserved\": \"2024-03-25T09:12:14.112Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-10T18:56:24.383Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.