CVE-2021-47203

What it actually does

Failure to clear a local fail_msg flag after adding a job to the completions list in lpfc_drain_txq() causes subsequent jobs from the txq list to be incorrectly added to both completions and txcmplq lists, resulting in list_add() corruption.

Why it matters to the business

May lead to kernel instability or crashes during storage I/O operations on affected systems, causing downtime and potential loss of availability for Fibre Channel connected storage; low EPSS indicates limited real-world risk.

How an attack unfolds

An attacker with local access triggers repeated failures when passing requests to the adapter in lpfc_drain_txq(), leaving the fail_msg flag set so that later jobs corrupt internal lists and potentially crash the system.

How to fix it

Upgrade phpservermon/phpservermon (GIT) to the fixed commit 162bba0046fcda1580f4fbc7b9ababe3c7c13ce4; apply the equivalent kernel patch clearing fail_msg after each completion-list addition.

How to confirm the fix worked

Confirm the fail_msg variable is cleared immediately after adding a job to the completions list; verify no duplicate list_add calls occur for the same job in txcmplq and completions paths.

Typical attack path

1. Obtain local access to a system using the lpfc driver
2. Induce conditions causing repeated txq drain failures
3. Trigger list corruption via continued processing of the txq list
4. Cause denial of service through resulting kernel panic or corruption

How to detect it

Review kernel logs and dmesg output for lpfc_drain_txq messages mentioning fail_msg or list corruption; inspect for unexpected panics during txq processing on systems with Emulex adapters.

What your security team should do

• Apply the listed fixed commit immediately on any systems running affected lpfc code
• Monitor kernel logs for lpfc_drain_txq related list corruption warnings
• Prioritize patching on production storage servers given potential for local DoS