CVE-2021-47138: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47138 affects the Linux kernel's cxgb4 driver, where hardware registers containing the server TID base can have invalid values when the adapter is in a bad state (e.g., due to AER fatal error). The vulnerability was discovered in 2021 and affects various Linux distributions including Red Hat Enterprise Linux and SUSE Linux Enterprise Server (Red Hat Portal, Kernel Commit).

The vulnerability occurs in the cxgb4_filter.c file where reading invalid values from the LE_DB_SRVR_START_INDEX_A register can lead to out-of-bounds memory access. The issue specifically affects the clear_all_filters function when the adapter is in a compromised state. The CVSS v3 base score is 6.0 (Moderate), with attack vector being Local, attack complexity Low, and requiring High privileges (Red Hat Portal).

When exploited, this vulnerability can result in out-of-bounds memory access, which can potentially cause memory corruption or system crashes. The impact primarily affects system stability and potentially data integrity (Red Hat Portal).

The vulnerability requires local access and high privileges to exploit. It specifically occurs when the network adapter is in a bad state, such as during an AER (Advanced Error Reporting) fatal error condition (Kernel Commit).

The fix involves using the saved server TID base (adapter->tids.stid_base) instead of reading directly from the hardware register when clearing filters. This patch has been implemented in various Linux kernel versions and is available through distribution updates. Users are recommended to upgrade to a supported product version that includes the fix (Red Hat Portal).