CVE-2021-47548

CRITICAL
Published May 24, 2024 Modified Apr 1, 2025 CWE-129

Description

In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF_GE_NUM (i.e., 8). However, if the value of port is 6 or 7, an array overflow could occur: port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off; because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6). To fix this possible array overflow, we first check port and if it is greater than or equal to DSAF_MAX_PORT_NUM, the function returns.

Is your site exposed to CVE-2021-47548?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-129 CWE-129

Affected Products

Vendor Product
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel

References

Advisories & Patches

https://git.kernel.org/stable/c/22519eff7df2d88adcc2568d86046ce1e2b52803 https://git.kernel.org/stable/c/948968f8747650447c8f21c9fdba0e1973be040b https://git.kernel.org/stable/c/99bb25cb6753beaf2c2bc37927c2ecc0ceff3f6d https://git.kernel.org/stable/c/a66998e0fbf213d47d02813b9679426129d0d114 https://git.kernel.org/stable/c/abbd5faa0748d0aa95d5191d56ff7a17a6275bd1 https://git.kernel.org/stable/c/dd07f8971b81ad98cc754b179b331b57f35aa1ff https://git.kernel.org/stable/c/fc7ffa7f10b9454a86369405d9814bf141b30627 https://git.kernel.org/stable/c/22519eff7df2d88adcc2568d86046ce1e2b52803 https://git.kernel.org/stable/c/948968f8747650447c8f21c9fdba0e1973be040b https://git.kernel.org/stable/c/99bb25cb6753beaf2c2bc37927c2ecc0ceff3f6d https://git.kernel.org/stable/c/a66998e0fbf213d47d02813b9679426129d0d114 https://git.kernel.org/stable/c/abbd5faa0748d0aa95d5191d56ff7a17a6275bd1 https://git.kernel.org/stable/c/dd07f8971b81ad98cc754b179b331b57f35aa1ff https://git.kernel.org/stable/c/fc7ffa7f10b9454a86369405d9814bf141b30627

Frequently Asked Questions

What is CVE-2021-47548? +
In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF_GE_NUM (i.e., 8). However, if the value of port is 6 or 7, an array overflow could occur: port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off; because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6). To fix this possible array overflow, we first check port and if it is greater than or equal to DSAF_MAX_PORT_NUM, the function returns. It has a CVSS v3.1 base score of 9.8 (CRITICAL).
How severe is CVE-2021-47548? +
CVE-2021-47548 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.
What products are affected by CVE-2021-47548? +
CVE-2021-47548 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2021-47548? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-0657

A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent …
CVE-2025-66559

Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and …
CVE-2023-31309

Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when exporting …
CVE-2024-45569 9.8

Memory corruption while parsing the ML IE due to invalid frame content.
CVE-2024-24563 9.8

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, …
CVE-2024-31581 9.8

FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. This vulnerability allows attackers …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2021-47548 — free, no signup required.