CVE-2021-47216

What it actually does

Kernel pointers are leaked in log output because the advansys driver casts them to unsigned long and prints with %lx instead of the safe %p specifier.

Why it matters to the business

Attackers with access to kernel logs can obtain address information that assists in bypassing kernel ASLR for more serious exploits; the flaw affects Linux systems using the advansys SCSI driver but has seen negligible real-world exploitation.

How an attack unfolds

An attacker with local or privileged log access triggers the affected printk statements in the advansys driver, observes the leaked pointer values in dmesg or syslog, and uses the addresses to craft subsequent kernel memory corruption attacks.

How to fix it

Apply the upstream fix that replaces %lx casts with %p pointer formatting; update to a Linux kernel containing commit that resolves the pointer leak in drivers/scsi/advansys.c.

How to confirm the fix worked

Inspect the advansys driver source for use of %p (or %px) when printing pointers; confirm the vulnerable %lx casts are absent after patching and reboot; review kernel build logs or running dmesg for absence of the old format strings.

Typical attack path

1. Obtain access to kernel log output on a target system
2. Trigger advansys driver code paths that emit the %lx-formatted pointers
3. Extract leaked kernel addresses from the resulting log messages
4. Leverage addresses to improve reliability of follow-on kernel exploits

How to detect it

Search kernel logs and syslog archives for advansys messages containing pointer values printed with %lx formatting; correlate with process activity that initializes the advansys SCSI controller.

• advansys.*%lx
• ASC_DVC_VAR
• asc_dvc_var_t

What your security team should do

• Prioritize patching systems that still run the advansys driver
• Restrict unprivileged access to kernel logs via dmesg_restrict and syslog restrictions
• Monitor EPSS and KEV updates for any future change in exploitability