CVE-2021-47542

What it actually does

NULL pointer dereference in qlcnic_83xx_add_rings() when the indirect function ahw->hw_ops->alloc_mbx_args fails to allocate cmd.req.arg, leading to a crash on subsequent dereference.

Why it matters to the business

Local denial-of-service risk on systems using affected QLogic NIC drivers; can interrupt network connectivity and require reboot, with low real-world exploit likelihood given the failure conditions needed.

How an attack unfolds

An attacker with local access triggers the qlcnic_83xx_add_rings path under conditions where alloc_mbx_args returns failure (resource pressure or crafted input), then relies on the missing NULL check to dereference the uninitialized pointer and crash the kernel.

How to fix it

Apply the upstream fix that adds a failure check for alloc_mbx_args() mirroring the handling in mbx_cmd(); rebuild and deploy the kernel module. Monitor for any downstream backports in distribution kernels.

How to confirm the fix worked

Confirm the patch is present by inspecting qlcnic_83xx_add_rings() for the added return-value check after alloc_mbx_args(); re-run the static analyzer or attempt to induce allocation failure in a test environment to verify no crash occurs.

Typical attack path

1. Obtain local user access on a system with CONFIG_QLCNIC enabled and QLogic 83xx hardware
2. Trigger ring addition via network configuration or driver load that invokes qlcnic_83xx_add_rings
3. Force alloc_mbx_args to fail through memory pressure or specific device state
4. Cause kernel panic via the unchecked dereference of cmd.req.arg

How to detect it

Review kernel logs for oops or panic messages referencing qlcnic_83xx_add_rings or NULL dereference in the qlcnic module; correlate with device initialization or ring configuration events.

• qlcnic_83xx_add_rings
• NULL pointer dereference
• alloc_mbx_args

What your security team should do

• Prioritize patching any distribution kernels that include the vulnerable qlcnic code
• Limit use of QLogic 83xx adapters on multi-tenant or high-risk systems until fixed
• Add kernel oops and qlcnic module load events to monitoring for early detection of crashes