CVE-2021-47548

What it actually does

Insufficient bounds check in hns_dsaf_ge_srst_by_port allows port values of 6 or 7 to index beyond the 6-element mac_cb array, causing out-of-bounds memory access.

Why it matters to the business

Kernel instability or arbitrary code execution on systems using the affected Hisilicon DSAF hardware can lead to denial of service, data corruption, or full system compromise, increasing downtime and remediation costs.

How an attack unfolds

An attacker supplies a port value between 6 and 7 to the vulnerable function, bypassing the DSAF_GE_NUM check and triggering an out-of-bounds read or write on mac_cb; successful exploitation may allow kernel memory corruption or control-flow hijacking.

How to fix it

Update redhatinsights/insights-client to commit 0460a41a53b620e7169f531febe9e4ded702ae22 or later; rebuild and deploy the patched kernel module containing the corrected DSAF_MAX_PORT_NUM check.

How to confirm the fix worked

Confirm the presence of the updated commit in the running kernel source or binary; inspect hns_dsaf_misc.c to verify the port check now uses DSAF_MAX_PORT_NUM before the mac_cb access.

Typical attack path

1. Identify systems exposing the Hisilicon DSAF driver interface
2. Craft input that sets port to 6 or 7 and invokes hns_dsaf_ge_srst_by_port
3. Trigger the array dereference to achieve out-of-bounds access
4. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for oops/panic messages referencing hns_dsaf_ge_srst_by_port or mac_cb array access; correlate with any recent configuration changes that set high port numbers on DSAF devices.

• hns_dsaf_ge_srst_by_port
• dsaf_dev->mac_cb[port]->port_rst_off
• DSAF_MAX_PORT_NUM
• DSAF_GE_NUM

What your security team should do

• Apply the referenced commit immediately on all affected hosts
• Scan for Hisilicon DSAF hardware and prioritize those systems
• Monitor kernel logs for related oops or panic entries during rollout
• Test the patched driver in a staging environment before production deployment