CVE-2021-47203

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47203", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-25T09:12:14.117Z", "datePublished": "2024-04-10T18:56:37.066Z", "dateUpdated": "2026-08-05T08:46:43.456Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:43.456Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()\n\nWhen parsing the txq list in lpfc_drain_txq(), the driver attempts to pass\nthe requests to the adapter. If such an attempt fails, a local \"fail_msg\"\nstring is set and a log message output. The job is then added to a\ncompletions list for cancellation.\n\nProcessing of any further jobs from the txq list continues, but since\n\"fail_msg\" remains set, jobs are added to the completions list regardless\nof whether a wqe was passed to the adapter. If successfully added to\ntxcmplq, jobs are added to both lists resulting in list corruption.\n\nFix by clearing the fail_msg string after adding a job to the completions\nlist. This stops the subsequent jobs from being added to the completions\nlist unless they had an appropriate failure."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - lpfc_drain_txq drains deferred ELS IOCBs on the Emulex FC HBA ELS ring; an adjacent FC/FCoE SAN fabric peer can induce discovery/ELS congestion that queues and drains those jobs, matching other lpfc adjacent-fabric scores.\nAC:L - A fabric attacker can flood ELS/discovery to exhaust SGLs (building a multi-job txq) and fill the WQ so one submit fails then later jobs succeed in the same drain; the sticky fail_msg bug then fires without relying on an uncontrollable memory layout.\nPR:N - The path runs in HBA/worker context on fabric-driven ELS traffic with no host authentication or capabilities required of the SAN peer.\nUI:N - ELS deferral and txq drain run automatically during fabric discovery and link events; no local user action is required.\nS:U - List corruption and resulting UAF stay inside the host kernel lpfc heap under the same OS authority; no VM escape or IOMMU/DMA boundary is crossed.\nC:H - Successfully submitted iocbqs are wrongly list_add'd onto completions while still on txcmplq, yielding list corruption and UAF of iocbq objects (including via iocbq_lookup on HW completion), enabling reclaim-assisted arbitrary read.\nI:H - Cancel invokes cmd_cmpl on the double-listed iocbq while HW completion still references it, producing a UAF with a callable function pointer suitable for heap grooming and control-flow hijack.\nA:H - Corrupted list walks and the subsequent UAF cause kernel oops/panic (or hangs under list corruption), fully denying host and FC storage-path availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/lpfc/lpfc_sli.c"], "versions": [{"version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "ad4776b5eb2e58af1226847fcd3b4f6d051674dd", "status": "affected", "versionType": "git"}, {"version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "ec70d80a8642900086447ba0cdc79e3f44d42e8f", "status": "affected", "versionType": "git"}, {"version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "f05a0191b90156e539cccc189b9d87ca2a4d9305", "status": "affected", "versionType": "git"}, {"version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "b291d147d0268e93ad866f8bc820ea14497abc9b", "status": "affected", "versionType": "git"}, {"version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "16bcbfb56d759c25665f786e33ec633b9508a08f", "status": "affected", "versionType": "git"}, {"version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "c097bd5a59162156d9c2077a2f58732ffbaa9fca", "status": "affected", "versionType": "git"}, {"version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "814d3610c4ce86e8cf285b2cdac0057a42e82de5", "status": "affected", "versionType": "git"}, {"version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "99154581b05c8fb22607afb7c3d66c1bace6aa5d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/lpfc/lpfc_sli.c"], "versions": [{"version": "2.6.36", "status": "affected"}, {"version": "0", "lessThan": "2.6.36", "status": "unaffected", "versionType": "semver"}, {"version": "4.4.293", "lessThanOrEqual": "4.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.291", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.256", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.218", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.162", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.82", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.5", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "4.4.293"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "4.9.291"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "4.14.256"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "4.19.218"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "5.4.162"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "5.10.82"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "5.15.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.36", "versionEndExcluding": "5.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd"}, {"url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f"}, {"url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305"}, {"url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b"}, {"url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f"}, {"url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca"}, {"url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5"}, {"url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d"}], "title": "scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47203", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T19:44:44.009129Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:14:01.015Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:07.414Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:07.414Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47203", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T19:44:44.009129Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:23.100Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - lpfc_drain_txq drains deferred ELS IOCBs on the Emulex FC HBA ELS ring; an adjacent FC/FCoE SAN fabric peer can induce discovery/ELS congestion that queues and drains those jobs, matching other lpfc adjacent-fabric scores.\nAC:L - A fabric attacker can flood ELS/discovery to exhaust SGLs (building a multi-job txq) and fill the WQ so one submit fails then later jobs succeed in the same drain; the sticky fail_msg bug then fires without relying on an uncontrollable memory layout.\nPR:N - The path runs in HBA/worker context on fabric-driven ELS traffic with no host authentication or capabilities required of the SAN peer.\nUI:N - ELS deferral and txq drain run automatically during fabric discovery and link events; no local user action is required.\nS:U - List corruption and resulting UAF stay inside the host kernel lpfc heap under the same OS authority; no VM escape or IOMMU/DMA boundary is crossed.\nC:H - Successfully submitted iocbqs are wrongly list_add'd onto completions while still on txcmplq, yielding list corruption and UAF of iocbq objects (including via iocbq_lookup on HW completion), enabling reclaim-assisted arbitrary read.\nI:H - Cancel invokes cmd_cmpl on the double-listed iocbq while HW completion still references it, producing a UAF with a callable function pointer suitable for heap grooming and control-flow hijack.\nA:H - Corrupted list walks and the subsequent UAF cause kernel oops/panic (or hangs under list corruption), fully denying host and FC storage-path availability."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "ad4776b5eb2e58af1226847fcd3b4f6d051674dd", "versionType": "git"}, {"status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "ec70d80a8642900086447ba0cdc79e3f44d42e8f", "versionType": "git"}, {"status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "f05a0191b90156e539cccc189b9d87ca2a4d9305", "versionType": "git"}, {"status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "b291d147d0268e93ad866f8bc820ea14497abc9b", "versionType": "git"}, {"status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "16bcbfb56d759c25665f786e33ec633b9508a08f", "versionType": "git"}, {"status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "c097bd5a59162156d9c2077a2f58732ffbaa9fca", "versionType": "git"}, {"status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "814d3610c4ce86e8cf285b2cdac0057a42e82de5", "versionType": "git"}, {"status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "lessThan": "99154581b05c8fb22607afb7c3d66c1bace6aa5d", "versionType": "git"}], "programFiles": ["drivers/scsi/lpfc/lpfc_sli.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.36"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.36", "versionType": "semver"}, {"status": "unaffected", "version": "4.4.293", "versionType": "semver", "lessThanOrEqual": "4.4.*"}, {"status": "unaffected", "version": "4.9.291", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.256", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.218", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.162", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.82", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.5", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/scsi/lpfc/lpfc_sli.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd"}, {"url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f"}, {"url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305"}, {"url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b"}, {"url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f"}, {"url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca"}, {"url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5"}, {"url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()\n\nWhen parsing the txq list in lpfc_drain_txq(), the driver attempts to pass\nthe requests to the adapter. If such an attempt fails, a local \"fail_msg\"\nstring is set and a log message output. The job is then added to a\ncompletions list for cancellation.\n\nProcessing of any further jobs from the txq list continues, but since\n\"fail_msg\" remains set, jobs are added to the completions list regardless\nof whether a wqe was passed to the adapter. If successfully added to\ntxcmplq, jobs are added to both lists resulting in list corruption.\n\nFix by clearing the fail_msg string after adding a job to the completions\nlist. This stops the subsequent jobs from being added to the completions\nlist unless they had an appropriate failure."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.4.293", "versionStartIncluding": "2.6.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.291", "versionStartIncluding": "2.6.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.256", "versionStartIncluding": "2.6.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.218", "versionStartIncluding": "2.6.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.162", "versionStartIncluding": "2.6.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.82", "versionStartIncluding": "2.6.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.5", "versionStartIncluding": "2.6.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16", "versionStartIncluding": "2.6.36"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:43.456Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47203", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:46:43.456Z", "dateReserved": "2024-03-25T09:12:14.117Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-10T18:56:37.066Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/scsi/lpfc/lpfc_sli.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ad4776b5eb2e58af1226847fcd3b4f6d051674dd", "status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "versionType": "git"}, {"lessThan": "ec70d80a8642900086447ba0cdc79e3f44d42e8f", "status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "versionType": "git"}, {"lessThan": "f05a0191b90156e539cccc189b9d87ca2a4d9305", "status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "versionType": "git"}, {"lessThan": "b291d147d0268e93ad866f8bc820ea14497abc9b", "status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "versionType": "git"}, {"lessThan": "16bcbfb56d759c25665f786e33ec633b9508a08f", "status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "versionType": "git"}, {"lessThan": "c097bd5a59162156d9c2077a2f58732ffbaa9fca", "status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "versionType": "git"}, {"lessThan": "814d3610c4ce86e8cf285b2cdac0057a42e82de5", "status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "versionType": "git"}, {"lessThan": "99154581b05c8fb22607afb7c3d66c1bace6aa5d", "status": "affected", "version": "2a9bf3d011303d8da64cd5e0e7fdd95f0c143984", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/scsi/lpfc/lpfc_sli.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.36"}, {"lessThan": "2.6.36", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.4.*", "status": "unaffected", "version": "4.4.293", "versionType": "semver"}, {"lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.291", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.256", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.218", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.162", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.82", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "83024F84-4857-4CAF-957E-C14804BAC4AF", "versionEndExcluding": "4.4.293", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B1EE39E-FE30-4B7D-A26F-631135BCBB3F", "versionEndExcluding": "4.9.291", "versionStartIncluding": "4.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FCEB92FF-21BF-4F75-ACA1-6AE1D51A79FC", "versionEndExcluding": "4.14.256", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F85F433-5DEA-47D3-B07E-3B1AC474D6E0", "versionEndExcluding": "4.19.218", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "51A152D8-D5CE-47BD-9041-DEE164DCE99D", "versionEndExcluding": "5.4.162", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE501832-500C-4EF1-9489-5C13674F619D", "versionEndExcluding": "5.10.82", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2128A085-4C0C-4C1E-9E9C-0DD868E2170F", "versionEndExcluding": "5.15.5", "versionStartIncluding": "5.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()\n\nWhen parsing the txq list in lpfc_drain_txq(), the driver attempts to pass\nthe requests to the adapter. If such an attempt fails, a local \"fail_msg\"\nstring is set and a log message output. The job is then added to a\ncompletions list for cancellation.\n\nProcessing of any further jobs from the txq list continues, but since\n\"fail_msg\" remains set, jobs are added to the completions list regardless\nof whether a wqe was passed to the adapter. If successfully added to\ntxcmplq, jobs are added to both lists resulting in list corruption.\n\nFix by clearing the fail_msg string after adding a job to the completions\nlist. This stops the subsequent jobs from being added to the completions\nlist unless they had an appropriate failure."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: Se corrige la corrupci\u00f3n de list_add() en lpfc_drain_txq() Al analizar la lista txq en lpfc_drain_txq(), el controlador intenta pasar las solicitudes al adaptador. Si dicho intento falla, se establece una cadena \"fail_msg\" local y se genera un mensaje de registro. Luego, el trabajo se agrega a una lista de finalizaciones para su cancelaci\u00f3n. El procesamiento de cualquier otro trabajo de la lista txq contin\u00faa, pero como \"fail_msg\" permanece establecido, los trabajos se agregan a la lista de finalizaciones independientemente de si se pas\u00f3 un wqe al adaptador. Si se agrega correctamente a txcmplq, los trabajos se agregan a ambas listas, lo que da como resultado la corrupci\u00f3n de la lista. Se soluciona borrando la cadena fail_msg despu\u00e9s de agregar un trabajo a la lista de finalizaciones. Esto evita que los trabajos posteriores se agreguen a la lista de finalizaciones a menos que hayan tenido una falla apropiada."}], "id": "CVE-2021-47203", "lastModified": "2026-08-04T10:16:52.533", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47203", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-04-10T19:44:44.009129Z", "version": "2.0.3"}}]}, "published": "2024-04-10T19:15:48.217", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2022:1988", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-372.9.1.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-05-10T00:00:00Z"}], "bugzilla": {"description": "kernel: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()", "id": "2274634", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274634"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()\nWhen parsing the txq list in lpfc_drain_txq(), the driver attempts to pass\nthe requests to the adapter. If such an attempt fails, a local \"fail_msg\"\nstring is set and a log message output. The job is then added to a\ncompletions list for cancellation.\nProcessing of any further jobs from the txq list continues, but since\n\"fail_msg\" remains set, jobs are added to the completions list regardless\nof whether a wqe was passed to the adapter. If successfully added to\ntxcmplq, jobs are added to both lists resulting in list corruption.\nFix by clearing the fail_msg string after adding a job to the completions\nlist. This stops the subsequent jobs from being added to the completions\nlist unless they had an appropriate failure.", "A vulnerability was found in the Linux kernel while parsing the txq list in the lpfc_drain_txq() function. Due to improper handling of a local fail message string which is set when a job fails and is never unset for subsequent jobs, this issue can lead to list corruption as jobs may be added to both the txq and the completions list. This could result in system instability or inconsistencies."], "name": "CVE-2021-47203", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47203\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47203\nhttps://lore.kernel.org/linux-cve-announce/2024041037-CVE-2021-47203-ff72@gregkh/T"], "statement": "This issue is fixed in RHEL-8.6 and above (including 8.10):\n~~~\nin (rhel-8.6, rhel-8.7, rhel-8.8, rhel-8.9, rhel-8.10) scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()\n~~~", "threat_severity": "Moderate"}

{}