CVE-2021-47398

What it actually does

The flaw allows kernel pointers to be printed using %llx after casting to unsigned long long instead of using the %p format specifier, exposing kernel memory addresses in logs or debug output.

Why it matters to the business

Attackers may obtain kernel address information that assists in bypassing protections and escalating privileges on affected Linux systems, increasing overall exposure in environments using RDMA hardware.

How an attack unfolds

An attacker triggers the vulnerable print path in the hfi1 RDMA driver, captures the resulting log output containing leaked kernel pointers, and uses the disclosed addresses to craft subsequent exploits against the same system.

How to fix it

Update the Linux kernel to a version containing the fix that replaces %llx with %p for the affected pointer prints in the RDMA/hfi1 driver.

How to confirm the fix worked

Verify the kernel source no longer contains the unsafe %llx cast for the pointer, or confirm the running kernel is newer than the patch that introduced the %p change.

Typical attack path

1. Gain local or log access on a system running the vulnerable hfi1 driver
2. Trigger the code path that prints the pointer with %llx
3. Capture the log message containing the leaked kernel address
4. Reuse the address to defeat KASLR or similar mitigations in follow-on attacks

How to detect it

Search system logs and dmesg output for pointer values printed with %llx formatting originating from the hfi1 driver; absence of such messages after patching indicates the leak path is closed.

What your security team should do

• Apply the kernel update containing the pointer-print fix on all systems using hfi1 RDMA hardware
• Review logging configurations to limit exposure of kernel debug output
• Monitor EPSS and KEV updates given the 881-day publication age and stable low exploit probability