CVE-2021-47485

Q: What is the severity of CVE-2021-47485?

CVE-2021-47485 has a CVSS score of 7.8 (HIGH). This CVE describes a buffer overflow vulnerability in the Linux kernel's InfiniBand driver (qib). Attackers with local access can exploit integer overflows in user-controlled fields to overflow kernel memory buffers, potentially leading to privilege escalation or system crashes. Systems running vulnerable Linux kernel versions with the qib driver loaded are affected.

7.8 HIGH

Buffer Overflow

📋 TL;DR

This CVE describes a buffer overflow vulnerability in the Linux kernel's InfiniBand driver (qib). Attackers with local access can exploit integer overflows in user-controlled fields to overflow kernel memory buffers, potentially leading to privilege escalation or system crashes. Systems running vulnerable Linux kernel versions with the qib driver loaded are affected.

💻 Affected Systems

Products:

Linux kernel with qib InfiniBand driver

Versions: Specific kernel versions between initial introduction of vulnerable code and patched versions (exact range requires checking git commits)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if qib driver is loaded (typically requires InfiniBand hardware or module loading). Most standard Linux installations won't have this driver loaded by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel memory corruption leading to system compromise, or denial of service through kernel panic.

🟠

Likely Case

Local privilege escalation allowing attackers to gain root access on affected systems.

🟢

If Mitigated

Limited to denial of service if proper kernel hardening and access controls prevent privilege escalation.

🌐 Internet-Facing: LOW - Requires local access to exploit, not directly reachable from internet.

🏢 Internal Only: HIGH - Local attackers or compromised user accounts can exploit this for privilege escalation.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and knowledge of driver interaction. No public exploit code identified in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 0d4395477741, 0f8cdfff0682, 3f57c3f67fd9, 60833707b968, 73d2892148aa

Vendor Advisory: https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify qib driver version matches patched kernel.

🔧 Temporary Workarounds

Unload qib driver

linux

Remove the vulnerable kernel module if not required

sudo rmmod qib

Blacklist qib module

linux

Prevent qib driver from loading at boot

echo 'blacklist qib' | sudo tee /etc/modprobe.d/blacklist-qib.conf

🧯 If You Can't Patch

Restrict local user access to systems with vulnerable kernel
Implement strict SELinux/AppArmor policies to limit driver access

🔍 How to Verify

Check if Vulnerable:

Check if qib module is loaded: lsmod | grep qib. If loaded, check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and qib module version matches. Check dmesg for any qib-related errors after patch.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
qib driver crash logs in dmesg
Failed module loading attempts

Network Indicators:

Unusual InfiniBand traffic patterns if driver exploited

SIEM Query:

Process execution from unusual users with qib-related system calls or kernel module interactions

📊 Metadata

CVE ID: CVE-2021-47485

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-120

Published: May 22, 2024

Last Updated: January 6, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Unload qib driver

Blacklist qib module

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities