CVE-2021-47153

What it actually does

Triggering a bus reset via the KILL bit in the i801 driver while interrupts are enabled causes the i801_isr handler to process an unexpected interrupt as a completed block transaction, resulting in an out-of-bounds memory access.

Why it matters to the business

Linux systems relying on the i801 SMBus controller may experience kernel crashes or memory corruption during recovery from timed-out I2C transactions, leading to service disruption and potential data loss on servers or embedded devices.

How an attack unfolds

An attacker or malicious process initiates an I2C transaction that times out, then forces a bus reset by setting the KILL bit; the resulting interrupt is mishandled by i801_isr, causing an out-of-range access during block data handling.

How to fix it

Apply the upstream kernel patch that disables interrupts before setting the KILL bit and re-enables them afterward; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the presence of the fix by inspecting the i801 driver source for interrupt disablement around KILL bit usage, or test by reproducing a timed-out transaction and verifying no crash occurs.

Typical attack path

1. Initiate a timed-out I2C/SMBus transaction on affected hardware
2. Set the KILL bit to trigger bus reset recovery
3. Allow the spurious interrupt to reach i801_isr
4. Trigger out-of-bounds memory access during block transaction processing
5. Cause kernel panic or memory corruption

How to detect it

Review kernel logs for oops or panic messages referencing i801_isr or out-of-range accesses during SMBus resets; correlate with processes performing I2C operations around the time of the crash.

What your security team should do

• Identify systems using the i801 driver via lspci or kernel config
• Prioritize kernel updates on production servers and embedded devices
• Monitor for related kernel oops reports in system logs
• Test the fix in a staging environment before wide deployment