CVE-2021-47081: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2021-47081) was discovered in the Linux kernel, affecting the gaudi component. The vulnerability occurs when a reference attempt to cb->id is made after it may have been previously freed during a call to the hl_cb_put() function in the gaudi_memset_device_memory function (Red Hat CVE).

The vulnerability exists in the gaudi_memset_device_memory function where cb is obtained via hl_cb_kernel_create() with 2 refcount. If hl_cs_allocate_job() fails, execution runs into the release_cb branch. One reference of cb is dropped by hl_cb_put(cb) and could be freed if another thread also drops one reference. The cb is then used via cb->id later, which creates a potential use-after-free condition (Kernel Commit).

The vulnerability has been assessed with a CVSS v3 base score of 4.4, indicating moderate severity. The vulnerability affects the availability of the system but does not impact confidentiality or integrity (Red Hat CVE).

The vulnerability requires local access and high privileges to exploit. The attack complexity is rated as low, but user interaction is not required for exploitation (Red Hat CVE).

The vulnerability has been fixed by adding a variable 'id' to store the value of cb->id before the hl_cb_put(cb) is called, thus avoiding the potential use-after-free condition. The fix has been implemented in the Linux kernel (Kernel Commit).