CVE-2021-47183

What it actually does

NULL pointer dereference in the lpfc driver during FC link-down handling of outstanding ELS/ABTS requests for fabric well-known addresses, allowing auto-completion to reference invalid structures and causing crashes or unload hangs.

Why it matters to the business

Unexpected system crashes or driver hangs in Fibre Channel SAN environments can interrupt storage access, delay maintenance, and reduce availability for workloads relying on Emulex/Broadcom HBAs.

How an attack unfolds

An attacker with local or physical access triggers an FC link-down event while PLOGIs remain outstanding; the driver issues ABTS without the link-down flag, stalls on link recovery, and dereferences invalid memory on completion or unload.

How to fix it

Upgrade the Linux kernel to a version containing the lpfc fix that sets the abort flag to suppress link traffic when the link has already failed; apply vendor backports for the affected distribution kernels.

How to confirm the fix worked

Confirm the running kernel contains the referenced lpfc commit; reproduce link-down scenarios in a test environment and verify absence of NULL dereference panics and repeated 2878 log messages.

Typical attack path

1. Gain local access or physical control over FC link state
2. Ensure PLOGI/ELS requests to fabric addresses are in-flight
3. Force link-down transition before link state is marked down
4. Trigger ABTS issuance and subsequent auto-completion or driver unload

How to detect it

Search kernel logs and dmesg for lpfc NULL pointer dereference traces and repeated 2878 messages during link events or module unload; correlate with SAN link-down events on systems using Emulex/Broadcom HBAs.

• 2878
• lpfc.*NULL pointer dereference
• lpfc.*ABTS.*link down

What your security team should do

• Identify all systems using lpfc drivers and schedule kernel updates within standard change windows
• Monitor vendor advisories for distribution-specific backports
• Test link-down and driver-unload sequences in staging SAN environments before production rollout
• Review logging configurations to capture lpfc 2878 messages for operational awareness