CVE-2021-47184 (GCVE-0-2021-47184)
Vulnerability from cvelistv5
Published
2024-04-10 18:56
Modified
2026-08-05 08:46
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL ptr dereference on VSI filter sync Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to sync this thread with sync filters subtask. Without this patch it is possible to start update the VSI filter list after VSI is removed, that's causing a kernel oops.
References
Impacted products
Vendor Product Version
Linux Linux Version: 41c445ff0f482bb6e6b72dcee9e598e20575f743
Version: 41c445ff0f482bb6e6b72dcee9e598e20575f743
Version: 41c445ff0f482bb6e6b72dcee9e598e20575f743
Version: 41c445ff0f482bb6e6b72dcee9e598e20575f743
Version: 41c445ff0f482bb6e6b72dcee9e598e20575f743
Version: 41c445ff0f482bb6e6b72dcee9e598e20575f743
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47184",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T19:33:14.911867Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:13:59.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.468Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e.h",
            "drivers/net/ethernet/intel/i40e/i40e_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78f2a9e831f9610e3655a0be5e675e1aa2472089",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            },
            {
              "lessThan": "87c421ab4a43433cb009fea44bbbc77f46913e1d",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            },
            {
              "lessThan": "c30162da91327e4cdf7cd03079f096bb3654738c",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            },
            {
              "lessThan": "f866513ead4370402428ef724b03c3312295c178",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            },
            {
              "lessThan": "e91e8427a1e1633a0261e3bb0201c836ac5b3890",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            },
            {
              "lessThan": "37d9e304acd903a445df8208b8a13d707902dea6",
              "status": "affected",
              "version": "41c445ff0f482bb6e6b72dcee9e598e20575f743",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e.h",
            "drivers/net/ethernet/intel/i40e/i40e_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.256",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.218",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.162",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.82",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix NULL ptr dereference on VSI filter sync\n\nRemove the reason of null pointer dereference in sync VSI filters.\nAdded new I40E_VSI_RELEASING flag to signalize deleting and releasing\nof VSI resources to sync this thread with sync filters subtask.\nWithout this patch it is possible to start update the VSI filter list\nafter VSI is removed, that\u0027s causing a kernel oops."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the host i40e PF driver and is reached via the SR-IOV VF virtchnl/mailbox path (MAC filter updates and VIRTCHNL_OP_RESET_VF/VFLR \u2192 i40e_vsi_release racing i40e_sync_filters_subtask), which requires local access to an assigned VF rather than remote packet processing.\nAC:L - A VF attacker controls both sides of the race by programming MAC filters (FILTER_CHANGED / MACVLAN_SYNC_PENDING) and then inducing VF reset/VFLR so the service task syncs while i40e_vsi_release frees the VSI; success does not depend on conditions outside attacker control.\nPR:L - Exploitation needs only guest/tenant control of an assigned VF (iavf virtchnl ops or VFLR), not real host root or init-namespace CAP_NET_ADMIN to write sriov_numvfs or unbind the PF.\nUI:N - The attacker alone drives filter updates and VF reset/VFLR; no separate victim action is required.\nS:C - A malicious VF guest triggers host-PF use-after-free/NULL dereference and host oops, denying availability of the host and co-tenants beyond the guest\u2019s security authority (guest-to-host impact).\nC:H - The service-task sync can wait on __I40E_VSI_SYNCING_FILTERS then resume after i40e_vsi_clear kfree\u2019s the VSI, yielding a heap UAF of the VSI object that per guidance enables reclaim-assisted arbitrary read.\nI:H - The same UAF of the VSI during concurrent filter sync versus release is heap-groomable into write/control-flow hijack primitives, so integrity impact is High rather than a pure crash-only NULL deref.\nA:H - The documented failure is a host kernel oops from syncing filters after VSI removal, and any UAF is scored High availability impact even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:33.774Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089"
        },
        {
          "url": "https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178"
        },
        {
          "url": "https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890"
        },
        {
          "url": "https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6"
        }
      ],
      "title": "i40e: Fix NULL ptr dereference on VSI filter sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47184",
    "datePublished": "2024-04-10T18:56:25.037Z",
    "dateReserved": "2024-03-25T09:12:14.112Z",
    "dateUpdated": "2026-08-05T08:46:33.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.468Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47184\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-10T19:33:14.911867Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:23.018Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"i40e: Fix NULL ptr dereference on VSI filter sync\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in the host i40e PF driver and is reached via the SR-IOV VF virtchnl/mailbox path (MAC filter updates and VIRTCHNL_OP_RESET_VF/VFLR \\u2192 i40e_vsi_release racing i40e_sync_filters_subtask), which requires local access to an assigned VF rather than remote packet processing.\\nAC:L - A VF attacker controls both sides of the race by programming MAC filters (FILTER_CHANGED / MACVLAN_SYNC_PENDING) and then inducing VF reset/VFLR so the service task syncs while i40e_vsi_release frees the VSI; success does not depend on conditions outside attacker control.\\nPR:L - Exploitation needs only guest/tenant control of an assigned VF (iavf virtchnl ops or VFLR), not real host root or init-namespace CAP_NET_ADMIN to write sriov_numvfs or unbind the PF.\\nUI:N - The attacker alone drives filter updates and VF reset/VFLR; no separate victim action is required.\\nS:C - A malicious VF guest triggers host-PF use-after-free/NULL dereference and host oops, denying availability of the host and co-tenants beyond the guest\\u2019s security authority (guest-to-host impact).\\nC:H - The service-task sync can wait on __I40E_VSI_SYNCING_FILTERS then resume after i40e_vsi_clear kfree\\u2019s the VSI, yielding a heap UAF of the VSI object that per guidance enables reclaim-assisted arbitrary read.\\nI:H - The same UAF of the VSI during concurrent filter sync versus release is heap-groomable into write/control-flow hijack primitives, so integrity impact is High rather than a pure crash-only NULL deref.\\nA:H - The documented failure is a host kernel oops from syncing filters after VSI removal, and any UAF is scored High availability impact even when not fully exploited.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"78f2a9e831f9610e3655a0be5e675e1aa2472089\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"87c421ab4a43433cb009fea44bbbc77f46913e1d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"c30162da91327e4cdf7cd03079f096bb3654738c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"f866513ead4370402428ef724b03c3312295c178\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"e91e8427a1e1633a0261e3bb0201c836ac5b3890\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41c445ff0f482bb6e6b72dcee9e598e20575f743\", \"lessThan\": \"37d9e304acd903a445df8208b8a13d707902dea6\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/i40e/i40e.h\", \"drivers/net/ethernet/intel/i40e/i40e_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.256\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.218\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.82\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/i40e/i40e.h\", \"drivers/net/ethernet/intel/i40e/i40e_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089\"}, {\"url\": \"https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d\"}, {\"url\": \"https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c\"}, {\"url\": \"https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178\"}, {\"url\": \"https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890\"}, {\"url\": \"https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni40e: Fix NULL ptr dereference on VSI filter sync\\n\\nRemove the reason of null pointer dereference in sync VSI filters.\\nAdded new I40E_VSI_RELEASING flag to signalize deleting and releasing\\nof VSI resources to sync this thread with sync filters subtask.\\nWithout this patch it is possible to start update the VSI filter list\\nafter VSI is removed, that\u0027s causing a kernel oops.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.256\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.218\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.162\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.82\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.5\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"3.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:33.774Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47184\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:33.774Z\", \"dateReserved\": \"2024-03-25T09:12:14.112Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-10T18:56:25.037Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.