CVE-2021-47203 (GCVE-0-2021-47203)

Vulnerability from cvelistv5 – Published: 2024-04-10 18:56 – Updated: 2026-08-05 08:46
VLAI
Title
scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass the requests to the adapter. If such an attempt fails, a local "fail_msg" string is set and a log message output. The job is then added to a completions list for cancellation. Processing of any further jobs from the txq list continues, but since "fail_msg" remains set, jobs are added to the completions list regardless of whether a wqe was passed to the adapter. If successfully added to txcmplq, jobs are added to both lists resulting in list corruption. Fix by clearing the fail_msg string after adding a job to the completions list. This stops the subsequent jobs from being added to the completions list unless they had an appropriate failure.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-10 19:44 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 , < ad4776b5eb2e58af1226847fcd3b4f6d051674dd (git)
Affected: 2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 , < ec70d80a8642900086447ba0cdc79e3f44d42e8f (git)
Affected: 2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 , < f05a0191b90156e539cccc189b9d87ca2a4d9305 (git)
Affected: 2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 , < b291d147d0268e93ad866f8bc820ea14497abc9b (git)
Affected: 2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 , < 16bcbfb56d759c25665f786e33ec633b9508a08f (git)
Affected: 2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 , < c097bd5a59162156d9c2077a2f58732ffbaa9fca (git)
Affected: 2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 , < 814d3610c4ce86e8cf285b2cdac0057a42e82de5 (git)
Affected: 2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 , < 99154581b05c8fb22607afb7c3d66c1bace6aa5d (git)
Create a notification for this product.
Linux Linux Affected: 2.6.36
Unaffected: 0 , < 2.6.36 (semver)
Unaffected: 4.4.293 , ≤ 4.4.* (semver)
Unaffected: 4.9.291 , ≤ 4.9.* (semver)
Unaffected: 4.14.256 , ≤ 4.14.* (semver)
Unaffected: 4.19.218 , ≤ 4.19.* (semver)
Unaffected: 5.4.162 , ≤ 5.4.* (semver)
Unaffected: 5.10.82 , ≤ 5.10.* (semver)
Unaffected: 5.15.5 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47203",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T19:44:44.009129Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:01.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.414Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/lpfc/lpfc_sli.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad4776b5eb2e58af1226847fcd3b4f6d051674dd",
              "status": "affected",
              "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
              "versionType": "git"
            },
            {
              "lessThan": "ec70d80a8642900086447ba0cdc79e3f44d42e8f",
              "status": "affected",
              "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
              "versionType": "git"
            },
            {
              "lessThan": "f05a0191b90156e539cccc189b9d87ca2a4d9305",
              "status": "affected",
              "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
              "versionType": "git"
            },
            {
              "lessThan": "b291d147d0268e93ad866f8bc820ea14497abc9b",
              "status": "affected",
              "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
              "versionType": "git"
            },
            {
              "lessThan": "16bcbfb56d759c25665f786e33ec633b9508a08f",
              "status": "affected",
              "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
              "versionType": "git"
            },
            {
              "lessThan": "c097bd5a59162156d9c2077a2f58732ffbaa9fca",
              "status": "affected",
              "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
              "versionType": "git"
            },
            {
              "lessThan": "814d3610c4ce86e8cf285b2cdac0057a42e82de5",
              "status": "affected",
              "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
              "versionType": "git"
            },
            {
              "lessThan": "99154581b05c8fb22607afb7c3d66c1bace6aa5d",
              "status": "affected",
              "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/lpfc/lpfc_sli.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.293",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.291",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.256",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.218",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.162",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.82",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()\n\nWhen parsing the txq list in lpfc_drain_txq(), the driver attempts to pass\nthe requests to the adapter. If such an attempt fails, a local \"fail_msg\"\nstring is set and a log message output.  The job is then added to a\ncompletions list for cancellation.\n\nProcessing of any further jobs from the txq list continues, but since\n\"fail_msg\" remains set, jobs are added to the completions list regardless\nof whether a wqe was passed to the adapter.  If successfully added to\ntxcmplq, jobs are added to both lists resulting in list corruption.\n\nFix by clearing the fail_msg string after adding a job to the completions\nlist. This stops the subsequent jobs from being added to the completions\nlist unless they had an appropriate failure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - lpfc_drain_txq drains deferred ELS IOCBs on the Emulex FC HBA ELS ring; an adjacent FC/FCoE SAN fabric peer can induce discovery/ELS congestion that queues and drains those jobs, matching other lpfc adjacent-fabric scores.\nAC:L - A fabric attacker can flood ELS/discovery to exhaust SGLs (building a multi-job txq) and fill the WQ so one submit fails then later jobs succeed in the same drain; the sticky fail_msg bug then fires without relying on an uncontrollable memory layout.\nPR:N - The path runs in HBA/worker context on fabric-driven ELS traffic with no host authentication or capabilities required of the SAN peer.\nUI:N - ELS deferral and txq drain run automatically during fabric discovery and link events; no local user action is required.\nS:U - List corruption and resulting UAF stay inside the host kernel lpfc heap under the same OS authority; no VM escape or IOMMU/DMA boundary is crossed.\nC:H - Successfully submitted iocbqs are wrongly list_add\u0027d onto completions while still on txcmplq, yielding list corruption and UAF of iocbq objects (including via iocbq_lookup on HW completion), enabling reclaim-assisted arbitrary read.\nI:H - Cancel invokes cmd_cmpl on the double-listed iocbq while HW completion still references it, producing a UAF with a callable function pointer suitable for heap grooming and control-flow hijack.\nA:H - Corrupted list walks and the subsequent UAF cause kernel oops/panic (or hangs under list corruption), fully denying host and FC storage-path availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:43.456Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305"
        },
        {
          "url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca"
        },
        {
          "url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5"
        },
        {
          "url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d"
        }
      ],
      "title": "scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47203",
    "datePublished": "2024-04-10T18:56:37.066Z",
    "dateReserved": "2024-03-25T09:12:14.117Z",
    "dateUpdated": "2026-08-05T08:46:43.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47203",
      "date": "2026-10-02",
      "epss": "0.00346",
      "percentile": "0.25826"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/lpfc/lpfc_sli.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ad4776b5eb2e58af1226847fcd3b4f6d051674dd",
                    "status": "affected",
                    "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ec70d80a8642900086447ba0cdc79e3f44d42e8f",
                    "status": "affected",
                    "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f05a0191b90156e539cccc189b9d87ca2a4d9305",
                    "status": "affected",
                    "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b291d147d0268e93ad866f8bc820ea14497abc9b",
                    "status": "affected",
                    "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "16bcbfb56d759c25665f786e33ec633b9508a08f",
                    "status": "affected",
                    "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c097bd5a59162156d9c2077a2f58732ffbaa9fca",
                    "status": "affected",
                    "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "814d3610c4ce86e8cf285b2cdac0057a42e82de5",
                    "status": "affected",
                    "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "99154581b05c8fb22607afb7c3d66c1bace6aa5d",
                    "status": "affected",
                    "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/lpfc/lpfc_sli.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.36"
                  },
                  {
                    "lessThan": "2.6.36",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.4.*",
                    "status": "unaffected",
                    "version": "4.4.293",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.291",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.256",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.218",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.162",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.82",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "83024F84-4857-4CAF-957E-C14804BAC4AF",
                    "versionEndExcluding": "4.4.293",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8B1EE39E-FE30-4B7D-A26F-631135BCBB3F",
                    "versionEndExcluding": "4.9.291",
                    "versionStartIncluding": "4.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FCEB92FF-21BF-4F75-ACA1-6AE1D51A79FC",
                    "versionEndExcluding": "4.14.256",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4F85F433-5DEA-47D3-B07E-3B1AC474D6E0",
                    "versionEndExcluding": "4.19.218",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "51A152D8-D5CE-47BD-9041-DEE164DCE99D",
                    "versionEndExcluding": "5.4.162",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AE501832-500C-4EF1-9489-5C13674F619D",
                    "versionEndExcluding": "5.10.82",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2128A085-4C0C-4C1E-9E9C-0DD868E2170F",
                    "versionEndExcluding": "5.15.5",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()\n\nWhen parsing the txq list in lpfc_drain_txq(), the driver attempts to pass\nthe requests to the adapter. If such an attempt fails, a local \"fail_msg\"\nstring is set and a log message output.  The job is then added to a\ncompletions list for cancellation.\n\nProcessing of any further jobs from the txq list continues, but since\n\"fail_msg\" remains set, jobs are added to the completions list regardless\nof whether a wqe was passed to the adapter.  If successfully added to\ntxcmplq, jobs are added to both lists resulting in list corruption.\n\nFix by clearing the fail_msg string after adding a job to the completions\nlist. This stops the subsequent jobs from being added to the completions\nlist unless they had an appropriate failure."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: Se corrige la corrupci\u00f3n de list_add() en lpfc_drain_txq() Al analizar la lista txq en lpfc_drain_txq(), el controlador intenta pasar las solicitudes al adaptador. Si dicho intento falla, se establece una cadena \"fail_msg\" local y se genera un mensaje de registro. Luego, el trabajo se agrega a una lista de finalizaciones para su cancelaci\u00f3n. El procesamiento de cualquier otro trabajo de la lista txq contin\u00faa, pero como \"fail_msg\" permanece establecido, los trabajos se agregan a la lista de finalizaciones independientemente de si se pas\u00f3 un wqe al adaptador. Si se agrega correctamente a txcmplq, los trabajos se agregan a ambas listas, lo que da como resultado la corrupci\u00f3n de la lista. Se soluciona borrando la cadena fail_msg despu\u00e9s de agregar un trabajo a la lista de finalizaciones. Esto evita que los trabajos posteriores se agreguen a la lista de finalizaciones a menos que hayan tenido una falla apropiada."
          }
        ],
        "id": "CVE-2021-47203",
        "lastModified": "2026-08-04T10:16:52.533",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47203",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T19:44:44.009129Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-10T19:15:48.217",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:02:40+00:00",
      "cve": "CVE-2021-47203",
      "id": "CVE-2021-47203",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "58",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47203.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:32:07.414Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47203",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-04-10T19:44:44.009129Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:23.100Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/scsi/lpfc/lpfc_sli.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "ad4776b5eb2e58af1226847fcd3b4f6d051674dd",
                  "status": "affected",
                  "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                  "versionType": "git"
                },
                {
                  "lessThan": "ec70d80a8642900086447ba0cdc79e3f44d42e8f",
                  "status": "affected",
                  "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                  "versionType": "git"
                },
                {
                  "lessThan": "f05a0191b90156e539cccc189b9d87ca2a4d9305",
                  "status": "affected",
                  "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                  "versionType": "git"
                },
                {
                  "lessThan": "b291d147d0268e93ad866f8bc820ea14497abc9b",
                  "status": "affected",
                  "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                  "versionType": "git"
                },
                {
                  "lessThan": "16bcbfb56d759c25665f786e33ec633b9508a08f",
                  "status": "affected",
                  "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                  "versionType": "git"
                },
                {
                  "lessThan": "c097bd5a59162156d9c2077a2f58732ffbaa9fca",
                  "status": "affected",
                  "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                  "versionType": "git"
                },
                {
                  "lessThan": "814d3610c4ce86e8cf285b2cdac0057a42e82de5",
                  "status": "affected",
                  "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                  "versionType": "git"
                },
                {
                  "lessThan": "99154581b05c8fb22607afb7c3d66c1bace6aa5d",
                  "status": "affected",
                  "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/scsi/lpfc/lpfc_sli.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.36"
                },
                {
                  "lessThan": "2.6.36",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.4.*",
                  "status": "unaffected",
                  "version": "4.4.293",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.291",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.256",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.218",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.162",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.82",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.16",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.4.293",
                      "versionStartIncluding": "2.6.36",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.291",
                      "versionStartIncluding": "2.6.36",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.256",
                      "versionStartIncluding": "2.6.36",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.218",
                      "versionStartIncluding": "2.6.36",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.162",
                      "versionStartIncluding": "2.6.36",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.82",
                      "versionStartIncluding": "2.6.36",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.5",
                      "versionStartIncluding": "2.6.36",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.16",
                      "versionStartIncluding": "2.6.36",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()\n\nWhen parsing the txq list in lpfc_drain_txq(), the driver attempts to pass\nthe requests to the adapter. If such an attempt fails, a local \"fail_msg\"\nstring is set and a log message output.  The job is then added to a\ncompletions list for cancellation.\n\nProcessing of any further jobs from the txq list continues, but since\n\"fail_msg\" remains set, jobs are added to the completions list regardless\nof whether a wqe was passed to the adapter.  If successfully added to\ntxcmplq, jobs are added to both lists resulting in list corruption.\n\nFix by clearing the fail_msg string after adding a job to the completions\nlist. This stops the subsequent jobs from being added to the completions\nlist unless they had an appropriate failure."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:A - lpfc_drain_txq drains deferred ELS IOCBs on the Emulex FC HBA ELS ring; an adjacent FC/FCoE SAN fabric peer can induce discovery/ELS congestion that queues and drains those jobs, matching other lpfc adjacent-fabric scores.\nAC:L - A fabric attacker can flood ELS/discovery to exhaust SGLs (building a multi-job txq) and fill the WQ so one submit fails then later jobs succeed in the same drain; the sticky fail_msg bug then fires without relying on an uncontrollable memory layout.\nPR:N - The path runs in HBA/worker context on fabric-driven ELS traffic with no host authentication or capabilities required of the SAN peer.\nUI:N - ELS deferral and txq drain run automatically during fabric discovery and link events; no local user action is required.\nS:U - List corruption and resulting UAF stay inside the host kernel lpfc heap under the same OS authority; no VM escape or IOMMU/DMA boundary is crossed.\nC:H - Successfully submitted iocbqs are wrongly list_add\u0027d onto completions while still on txcmplq, yielding list corruption and UAF of iocbq objects (including via iocbq_lookup on HW completion), enabling reclaim-assisted arbitrary read.\nI:H - Cancel invokes cmd_cmpl on the double-listed iocbq while HW completion still references it, producing a UAF with a callable function pointer suitable for heap grooming and control-flow hijack.\nA:H - Corrupted list walks and the subsequent UAF cause kernel oops/panic (or hangs under list corruption), fully denying host and FC storage-path availability."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:46:43.456Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd"
            },
            {
              "url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f"
            },
            {
              "url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305"
            },
            {
              "url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b"
            },
            {
              "url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f"
            },
            {
              "url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca"
            },
            {
              "url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5"
            },
            {
              "url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d"
            }
          ],
          "title": "scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47203",
        "datePublished": "2024-04-10T18:56:37.066Z",
        "dateReserved": "2024-03-25T09:12:14.117Z",
        "dateUpdated": "2026-08-05T08:46:43.456Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.