CVE-2021-47308

What it actually does

An out-of-bounds array index access occurs in fc_rport_prli_resp() inside the libfc SCSI subsystem, allowing memory corruption consistent with the BufferOverflow family.

Why it matters to the business

Linux systems using Fibre Channel storage may encounter kernel crashes or corruption that interrupt storage I/O and require reboots, though low EPSS and lack of KEV listing limit operational urgency.

How an attack unfolds

An attacker with the ability to inject a crafted PRLI response frame into an FC fabric could supply an index that exceeds the allocated array in fc_rport_prli_resp(); no public exploit code or threat-actor campaigns are known.

How to fix it

Upgrade to a Linux kernel containing the bounds check fix for fc_rport_prli_resp(); apply the patch referenced in the commit that resolved the array index exception.

How to confirm the fix worked

Verify the presence of the bounds-checking code in fc_rport_prli_resp() within the running kernel source or confirm the kernel version incorporates the upstream fix.

Typical attack path

1. Locate hosts exposing libfc over Fibre Channel
2. Inject a malicious PRLI response frame
3. Trigger the unchecked array access to corrupt memory

How to detect it

Search kernel logs for oops or panic messages referencing fc_rport_prli_resp, and inspect Fibre Channel frame captures for anomalous PRLI responses.

What your security team should do

• Prioritize kernel updates on systems that load the libfc module
• Disable unused Fibre Channel interfaces where possible
• Monitor EPSS trend and re-evaluate if exploit maturity increases