CVE-2021-47229

What it actually does

Race condition in the aardvark PCI driver allows a new PIO transfer to be started by writing to PIO_START while a prior transfer is still in progress (indicated by PIO_START remaining 1), triggering an External Abort on the CPU that results in kernel panic via asynchronous SError.

Why it matters to the business

Systems using affected hardware may experience unexpected kernel crashes and reboots during PCI link events such as retraining or link down, causing unplanned downtime and reduced availability.

How an attack unfolds

An attacker with local access or the ability to trigger PCI link state changes can force overlapping PIO operations; when the driver issues a new transfer before the previous one times out (up to 1.44 s), the resulting External Abort panics the kernel. No named threat actors or ransomware campaigns are associated.

How to fix it

Update the Linux kernel to a version containing the upstream fix that rejects new PIO requests unless the prior transfer has timed out; after patching, the related Trusted Firmware-A EL3 SError workaround can be removed.

How to confirm the fix worked

Confirm the kernel version includes the aardvark PIO_START check; reproduce link retraining or link-down events under load and verify absence of SError 0xbf000002 panics; review dmesg for successful PIO timeout handling instead of abort.

Typical attack path

1. Trigger PCI link retraining or link-down event on affected hardware
2. Issue or wait for a PIO transfer that has not yet completed
3. Force the kernel to start a subsequent PIO transfer while PIO_START is still asserted
4. Induce External Abort leading to kernel panic and denial of service

How to detect it

Search kernel logs and dmesg for 'SError Interrupt', 'code 0xbf000002', and 'Asynchronous SError Interrupt'; correlate with PCI link retraining or link-down events; examine system crash dumps for PIO transfer state around the time of panic.

• SError Interrupt on CPU
• code 0xbf000002
• Asynchronous SError Interrupt
• PIO_START register write while value 1

What your security team should do

• Prioritize kernel updates on all systems using the aardvark PCI controller
• Monitor for kernel panics containing 'Asynchronous SError Interrupt' or code 0xbf000002
• Test link-state change scenarios in staging environments before production rollout
• Remove the TF-A EL3 SError suppression hack once kernels are patched