CVE-2021-47286

What it actually does

The MHI bus driver reads an untrusted channel ID (0-255) from a device-supplied event ring element and indexes into per-channel data structures without validating the ID against the controller's maximum supported channels or whether the channel has been configured, enabling out-of-bounds memory access.

Why it matters to the business

Systems using MHI controllers (commonly found in cellular modems and certain embedded platforms) may experience kernel crashes, memory corruption, or denial of service; the flaw has low public exploitability and is not known to be used in ransomware or by named threat actors.

How an attack unfolds

An attacker with the ability to control or emulate an MHI device crafts an event ring element containing a channel ID larger than the number of configured channels; when the driver processes the completion event it performs an unchecked array access, potentially reading or writing adjacent kernel memory.

How to fix it

Update the Linux kernel to a version containing commit "bus: mhi: core: Validate channel ID when processing command completions" (or any later stable release that includes the fix). Reboot systems after applying the kernel update.

How to confirm the fix worked

Confirm the presence of the validation check in drivers/bus/mhi/core/main.c (or equivalent) that compares the channel ID against the controller's chdb array size and the channel's configured state before processing the event element; recompile and boot the patched kernel, then exercise MHI command completions with both valid and invalid channel IDs.

Typical attack path

1. Gain ability to supply or modify MHI event ring elements (via compromised firmware, malicious PCIe device, or hypervisor escape)
2. Construct an event ring element with a channel ID outside the valid range or for an unconfigured channel
3. Trigger command completion processing in the MHI core driver
4. Cause out-of-bounds memory read/write leading to crash or further exploitation

How to detect it

Examine kernel logs for MHI-related oops, BUG, or WARN messages that reference channel ID indexing or array bounds; look for unexpected MHI event ring processing failures on systems with MHI controllers.

What your security team should do

• Apply the upstream kernel fix immediately on any system exposing MHI devices
• Prioritize updates for devices that use MHI modems or similar controllers
• Monitor vendor kernel update channels for backported patches