CVE-2021-47587

What it actually does

Race condition in the SYSTEMPORT transmit descriptor lifecycle allows concurrent producers across multiple TX queues to corrupt the shared descriptor list and internal hardware allocation, causing the hardware to use incorrect length/status fields for data buffers and compute checksums over wrong packet lengths.

Why it matters to the business

Networking devices using the affected Linux kernel driver may experience packet corruption, checksum failures, and unreliable data transmission when multiple transmit queues are active, potentially leading to application errors or degraded network performance; the issue has low public exploitability and no known ransomware use.

How an attack unfolds

An attacker with the ability to generate concurrent traffic across multiple transmit queues (for example via multiple flows or sockets) can trigger simultaneous writes to the WRITE_PORT registers; the absence of global serialization allows the hardware to re-arrange descriptors inconsistently, resulting in descriptor corruption that manifests as incorrect UDP/TCP checksums.

How to fix it

Apply the upstream fix that adds global locking around the WRITE_PORT register writes for all TX queues; rebuild and deploy the patched kernel on affected systems; where patching is delayed, limit the driver to a single transmit queue as a temporary mitigation.

How to confirm the fix worked

Confirm the presence of the global lock around WRITE_PORT writes in the systemport driver source; test with multi-queue UDP/TCP traffic and verify that checksums are computed over correct packet lengths; monitor for absence of descriptor corruption symptoms under concurrent load.

Typical attack path

1. Establish multiple concurrent transmit queues or flows on a SYSTEMPORT interface
2. Trigger simultaneous descriptor production by writing to WRITE_PORT_HI/LO registers from different queues
3. Rely on hardware re-ordering delay to cause descriptor list corruption
4. Observe resulting packet checksum errors or malformed transmissions

How to detect it

Examine kernel logs and network stack traces for checksum mismatch warnings or descriptor-related errors under multi-queue workloads; review git history or kernel binary for the presence of the global lock commit; no widespread in-the-wild exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates containing the descriptor locking change on all systems using the SYSTEMPORT driver
• Review network driver configuration to determine current queue usage and plan single-queue fallback if immediate patching is not feasible
• Include the patched kernel in standard image rebuild and deployment pipelines
• Monitor EPSS and KEV status for any future changes in exploit availability