Security readout for executives and security teams
Plain-English summary
This is a Linux kernel hardware-monitoring bug in the mlxreg-fan fan driver. When fan minimum speed is enforced through sysfs, the kernel can read beyond a thermal statistics table if CONFIG_THERMAL_STATISTICS is enabled. The source shows a KASAN slab out-of-bounds read, but provides no CVSS score or confirmed exploitation.
Executive priority
Treat as a targeted kernel maintenance item, not an internet-wide emergency based on the supplied evidence. Prioritize systems that use this fan driver in production appliances or platforms where local administrators or automation can write fan-control sysfs values.
Technical view
The mlxreg-fan driver can pass an enforced fan state above the nominal cooling-device maximum. With CONFIG_THERMAL_STATISTICS enabled, thermal_cooling_device_stats_update() may access outside its statistics table. The resolved change returns a non-zero value for configuration writes so the thermal statistics update is skipped for that out-of-range state.
Likely exposure
Likely limited to Linux systems using the mlxreg-fan driver with thermal statistics enabled and sysfs fan control paths available. Exposure depends on kernel version, hardware support, configuration, and who can write the relevant sysfs controls.
Exploitation context
The bundle does not show CISA KEV listing, public exploitation, exploit code, or remote attack evidence. The observed trigger is a sysfs write path used to enforce fan speed minimums, so practical abuse likely requires local or privileged access to that interface.
Researcher notes
Key uncertainty is exploitability beyond the demonstrated KASAN out-of-bounds read. The source describes the faulty range interaction and fix behavior, but not confidentiality impact, privilege requirements, or affected hardware inventory beyond Linux mlxreg-fan contexts.
Mitigation direction
- Update to a Linux kernel containing one of the referenced stable fixes.
- Check distribution vendor advisories for backported kernel packages.
- Restrict write access to fan-control sysfs paths to trusted administrators.
- Review whether CONFIG_THERMAL_STATISTICS is enabled on exposed systems.
Validation and detection
- Inventory kernels in the affected version ranges from the CVE record.
- Confirm whether the mlxreg-fan module or built-in driver is present.
- Check kernel configuration for CONFIG_THERMAL_STATISTICS.
- Verify vendor kernel changelogs include the referenced fix.
- Review logs for KASAN or thermal_cooling_device_stats_update out-of-bounds reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47393 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6caCVE reference, Linux
- https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8aCVE reference, Linux
- https://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930CVE reference, Linux
- https://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8CVE reference, Linux
- https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.