CVE-2021-47485

What it actually does

Unchecked arithmetic on user-supplied addrlimit and bytes_togo fields in struct qib_user_sdma_pkt allows userspace to overflow kernel buffers in the qib SDMA path.

Why it matters to the business

Attackers who can reach the affected InfiniBand hardware driver can corrupt kernel memory, leading to crashes, data corruption, or local privilege escalation on Linux systems that use QLogic IB adapters.

How an attack unfolds

A local attacker opens the qib device, prepares a qib_user_sdma_pkt structure with malicious addrlimit or bytes_togo values, and submits it via the SDMA interface; the driver performs unchecked math on these values and writes beyond the end of kernel buffers.

How to fix it

Upgrade the Linux kernel to a version containing commit that adds overflow checks for addrlimit and bytes_togo in the qib_user_sdma code path; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Inspect the qib_user_sdma.c source for the added overflow guards; confirm the running kernel version includes the fix or verify the device driver no longer accepts oversized values without error.

Typical attack path

1. Obtain local shell on a system exposing /dev/infiniband/qib*
2. Open the qib device and map required user-space regions
3. Craft qib_user_sdma_pkt entries with overflow-sized addrlimit/bytes_togo
4. Submit the SDMA request via the appropriate ioctl
5. Trigger kernel buffer overflow and gain arbitrary read/write or DoS

How to detect it

Review kernel logs for oops or page-fault messages originating from qib_user_sdma functions; correlate with processes that opened qib device files shortly before the crash.

What your security team should do

• Identify all Linux hosts with qib InfiniBand drivers enabled
• Schedule kernel updates within the next maintenance window
• Restrict unprivileged access to /dev/infiniband devices via udev or AppArmor/SELinux policies
• Monitor for future kernel updates that back-port this fix to older LTS branches