CVE-2021-47002: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47002 affects the Linux kernel's SUNRPC (Remote Procedure Call) subsystem. The vulnerability was discovered in the svc_rqst_free() function where a null pointer dereference could occur when alloc_pages_node() returns null in svc_rqst_alloc(). This vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Moderate) (Red Hat Portal).

The vulnerability occurs in the net/sunrpc/svc.c file where the rq_scratch_page pointer could be dereferenced when calling put_page() in svc_rqst_free(), even if alloc_pages_node() had previously returned null. This is classified as CWE-476: NULL Pointer Dereference. The issue was fixed by adding a null check before calling put_page() (Kernel Commit).

The vulnerability has a Moderate impact with a CVSS v3.1 base score of 5.5. It primarily affects the availability of the system, with no impact on confidentiality or integrity. The attack requires local access and low privileges to exploit (Red Hat Portal).

The vulnerability requires local access and low privileges to exploit. The attack complexity is low, but user interaction is not required. The scope is unchanged, meaning the vulnerability can only affect resources managed by the same security authority (Red Hat Portal).

The vulnerability has been fixed in the Linux kernel by adding a null check before calling put_page() in the svc_rqst_free() function. The fix was implemented in commit b9f83ffaa0c096b4c832a43964fe6bff3acffe10. Users should update their Linux kernel to a version that includes this fix (Kernel Commit).