Critical NULL Pointer Dereference in Linux Kernel (CVE-2021-47183)
Summary
CVE-2021-47183: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix link down processing to address NULL pointer dereference If an FC link down transition while PLOGIs are outstanding to fabric well known... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services for software applications. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects the SCSI lpfc driver, which is responsible for managing Fibre Channel connections. The issue arises during link down transitions, potentially leading to system instability and driver hang-ups.
Vulnerability Detail
CVE-2021-47183 is a vulnerability in the Linux kernel's SCSI lpfc driver that can lead to a NULL pointer dereference. This occurs when an FC link goes down while outstanding PLOGIs are still active. The driver attempts to send Abort requests for outstanding ELS requests before properly setting the link state to down, which can cause the Abort requests to reference invalid structures if the link comes back up. This can result in system crashes or hangs, particularly during driver unload operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid performing operations that may trigger link down transitions while PLOGIs are outstanding. Monitor the system logs for repeated '2878' messages, which indicate potential issues with driver unload requests.
Conclusion
CVE-2021-47183 is a critical vulnerability in the Linux kernel's SCSI lpfc driver that can lead to serious system issues. It is essential for users to update their systems to the recommended versions to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47183 is a vulnerability in the Linux kernel's SCSI lpfc driver that can lead to a NULL pointer dereference during link down transitions.
The vulnerability can cause system crashes, hangs during driver unload operations, and instability in systems using the affected driver.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability affects Linux kernel versions prior to 5.15.5-1 on Debian 12 and 13.
Yes, the permanent fix is to update the Linux kernel to version 5.15.5-1 or later, which resolves the issue.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
