CVE-2021-47198
📋 TL;DR
A use-after-free vulnerability in the Linux kernel's lpfc SCSI driver allows local attackers to potentially crash the system or execute arbitrary code. This affects systems using the lpfc driver for Emulex Fibre Channel adapters. Attackers need local access to exploit this vulnerability.
💻 Affected Systems
- Linux kernel with lpfc driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to kernel compromise, system crash, or arbitrary code execution with kernel privileges.
Likely Case
Kernel panic or system crash causing denial of service when unloading the lpfc driver.
If Mitigated
No impact if proper access controls prevent local users from unloading kernel modules.
🎯 Exploit Status
Requires local access and ability to unload kernel modules. Exploitation requires understanding of kernel memory layout and timing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in kernel commits 79b20beccea3a3938a8500acef4e6b9d7c66142f and dbebf865b3239595c1d4dba063b122862583b52a
Vendor Advisory: https://git.kernel.org/stable/c/79b20beccea3a3938a8500acef4e6b9d7c66142f
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix. 2. Check with your distribution for specific patched kernel versions. 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Restrict module unloading
linuxPrevent unauthorized users from unloading kernel modules
echo 1 > /proc/sys/kernel/modules_disabled
chmod 600 /proc/sys/kernel/modules_disabled
Disable lpfc module
linuxIf not using Fibre Channel adapters, blacklist the lpfc module
echo 'blacklist lpfc' >> /etc/modprobe.d/blacklist.conf
🧯 If You Can't Patch
- Restrict local user access to systems with vulnerable kernels
- Implement strict access controls to prevent unauthorized users from unloading kernel modules
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if lpfc module is loaded: lsmod | grep lpfc && uname -rCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is updated to patched version and check for presence of fix commits in kernel source📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- KASAN use-after-free reports in dmesg
- System crashes when unloading lpfc module
Network Indicators:
- None - local vulnerability only
SIEM Query:
search 'KASAN: use-after-free in lpfc_unreg_rpi' OR 'kernel panic' AND 'lpfc'