Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory leak in the hfi1 InfiniBand/Omni-Path driver. During device reinitialization, the driver could allocate a new receive-header tail buffer without freeing the old one. The source does not describe remote code execution, data theft, or active exploitation.
Executive priority
Handle through normal Linux kernel patch management unless hfi1-equipped systems are business-critical or experiencing memory pressure. There is no sourced evidence of active exploitation.
Technical view
The hfi1 driver allocated rcvhdrtail_dummy_kvaddr in hfi1_init(). On the reinit path, that pointer could be overwritten, leaking the previous coherent DMA allocation. The fix moves allocation into hfi1_alloc_devdata() and deallocation into hfi1_free_devdata().
Likely exposure
Exposure appears limited to Linux systems using the IB/hfi1 driver and affected kernel builds. Systems without this driver or relevant hardware are unlikely to be exposed based on the provided sources.
Exploitation context
No KEV listing, exploit report, CVSS vector, or public exploitation evidence is provided. The described impact is a kernel memory leak triggered by a reinitialization path, not a directly documented external attack path.
Researcher notes
The evidence supports a resource leak in driver lifecycle handling. The affected-version data is incomplete in the prompt, so validate exact exposure against upstream stable commits and distribution-specific kernel backports.
Mitigation direction
- Check vendor kernel advisories for a backported hfi1 fix.
- Upgrade to a kernel containing the referenced stable fixes.
- Prioritize systems using IB/hfi1 hardware or loaded hfi1 modules.
- Monitor affected systems for memory pressure until patched.
Validation and detection
- Inventory kernel versions across Linux hosts.
- Identify hosts with the hfi1 driver loaded or packaged.
- Confirm deployed kernels include a referenced stable commit or vendor backport.
- Review change records for hfi1 reset or reinitialization events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47523 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2c08271f4ed0e24633b3f81ceff61052b9d45efcCVE reference, Linux
- https://git.kernel.org/stable/c/834d0fb978643eaf09da425de197cc16a7c2761bCVE reference, Linux
- https://git.kernel.org/stable/c/60a8b5a1611b4a26de4839ab9c1fc2a9cf3e17c1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.