CVE-2021-47095

What it actually does

Null pointer dereference in ipmi_ssif driver during probe error handling because ssif_info->client is dereferenced before initialization when an early error path is taken.

Why it matters to the business

Kernel crashes and unexpected reboots on Linux systems using the IPMI SSIF interface when device probing encounters specific error conditions, leading to availability loss.

How an attack unfolds

An attacker triggers the ssif_probe error path (for example by causing an interface-already-present condition) after partial error checking but before client initialization, resulting in NULL dereference and kernel panic.

How to fix it

Apply the upstream fix that initializes ssif_info->client early in the probe function and clears i2c_client data on error paths; update to a kernel containing the resolution for CVE-2021-47095.

How to confirm the fix worked

Inspect the ipmi_ssif source to confirm ssif_info->client is set before any error logging paths and that client data is cleared on errors; test probe error scenarios do not crash.

Typical attack path

1. Cause conditions that make ipmi_ssif probe enter an error path
2. Kernel executes error logging code that dereferences uninitialized ssif_info->client
3. NULL pointer dereference occurs leading to kernel crash

How to detect it

Search kernel logs and oops reports for ssif_probe calls followed by NULL pointer dereference in __dev_printk or _dev_err; look for the message indicating the interface is already present.

• ipmi_ssif 0-000e: ipmi_ssif: Not probing, Interface already present
• Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088
• ssif_probe+0x548/0x900

What your security team should do

• Prioritize kernel updates containing the ssif_probe initialization fix
• Monitor kernel logs for ipmi_ssif NULL dereference oops
• Restrict local access that could influence I2C device probing