LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47548: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()

In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF_GE_NUM (i.e., 8). However, if the value of port is 6 or 7, an array overflow could occur: port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off; because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6). To fix this possible array overflow, we first check port and if it is greater than or equal to DSAF_MAX_PORT_NUM, the function returns.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel bug in the Hisilicon HNS Ethernet driver. A port number check used the wrong upper bound, allowing possible access beyond an internal array. The record scores it critical, but the provided sources do not show active exploitation or identify exposed products beyond Linux kernels using this driver path.

Executive priority

Treat this as a high-priority kernel maintenance item where Hisilicon HNS Ethernet support is present. The score is critical, but urgency should be tied to actual driver use and asset exposure because the provided sources do not show active exploitation.

Technical view

CVE-2021-47548 is a CWE-129 array-index validation flaw in hns_dsaf_ge_srst_by_port(). The code limited port to DSAF_GE_NUM, while dsaf_dev->mac_cb is sized by DSAF_MAX_PORT_NUM. Ports 6 or 7 could exceed the mac_cb array. Kernel stable commits change the check to return when port is greater than or equal to DSAF_MAX_PORT_NUM.

Likely exposure

Exposure is most likely on Linux systems running affected kernel versions with the Hisilicon HNS DSAF Ethernet driver in use. The bundle lists Linux kernel versions and stable kernel fixes, but it does not name distributions, appliances, cloud images, or specific hardware models beyond the driver context.

Exploitation context

The CVSS vector indicates network attack, low complexity, no privileges, and high confidentiality, integrity, and availability impact. However, the CVE is not marked KEV, and the provided sources do not report exploitation in the wild, public exploit availability, or practical triggering conditions.

Researcher notes

The key issue is a bounds mismatch: DSAF_GE_NUM permits values the mac_cb array cannot hold. Research should focus on affected kernel branches, downstream backports, driver reachability, and whether any user-controllable network path can reach the reset function. The source bundle does not prove exploitability beyond the possible overflow.

Mitigation direction

  • Inventory Linux hosts using Hisilicon HNS Ethernet hardware or the hns driver.
  • Update affected kernels to versions containing the referenced stable fixes.
  • Check Linux distribution advisories for backported fixes matching this CVE.
  • Prioritize externally reachable or infrastructure-critical systems first.
  • If patch timing is constrained, seek vendor guidance for temporary exposure reduction.

Validation and detection

  • Confirm kernel version and distribution patch status against CVE-2021-47548 advisories.
  • Check whether the Hisilicon HNS DSAF Ethernet driver is present and active.
  • Map affected hosts to hardware, network role, and external reachability.
  • Verify the relevant kernel stable commit or downstream backport is included.
  • Record any compensating controls separately from patch completion.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-129: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-47548 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2021-47548Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux850bfa3b78ea8849fef78ed74f5f2ccf947db0ca, 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca, 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca, 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca, 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca, 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca, 850bfa3b78ea8849fef78ed74f5f2ccf947db0caunaffected
LinuxLinux4.7, 0, 4.9.292, 4.14.257, 4.19.220, 5.4.164, 5.10.84, 5.15.7, 5.16affected
Weakness

CWE details

CWE-129

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-129 · source CWE mapping

Improper Validation of Array Index

Improper Validation of Array Index represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs