CVE-2021-28971: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-28971 affects the Linux kernel through version 5.11.8, specifically impacting the intel_pmu_drain_pebs_nhm function in arch/x86/events/intel/ds.c. The vulnerability was discovered by Vince Weaver and affects systems with Intel Haswell CPUs and earlier models. The issue stems from mishandling of PEBS (Precise Event Based Sampling) status in PEBS records (Kernel Commit).

The vulnerability occurs in the performance event handler for Intel PEBS where a workaround for a hardware bug on Intel Haswell and earlier CPUs could lead to a null pointer dereference. The issue specifically affects the intel_pmu_drain_pebs_nhm function when handling PEBS records. The CVSS v3.1 base score is 5.5 (Medium) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When successfully exploited, this vulnerability can cause a system crash through a null pointer dereference, resulting in a denial of service condition. The impact is primarily limited to systems with affected Intel CPUs (Haswell and earlier) where users have access to performance events (Ubuntu Security).

The vulnerability can be triggered by userspace applications such as perf-fuzzer on affected systems. However, exploitation requires local access and the ability to access performance events. By default, unprivileged users do not have access to performance events, which mitigates this issue. This is controlled by the kernel.perf_event_paranoid sysctl (Debian Advisory).

The vulnerability has been fixed in various Linux distributions through security updates. For example, Debian 9 (Stretch) fixed it in version 4.9.272-1, and Ubuntu has provided fixes across multiple kernel versions. The primary mitigation for systems that cannot be immediately patched is ensuring that the kernel.perf_event_paranoid sysctl is set to restrict unprivileged user access to performance events (NetApp Advisory).