CVE-2021-47087: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47087 is a vulnerability in the Linux kernel's TEE (Trusted Execution Environment) OptEE driver, discovered and disclosed in March 2024. The vulnerability affects multiple versions of the Linux kernel, including versions from 5.4.140 to 5.4.169, 5.10.58 to 5.10.89, 5.14 to 5.15.12, and various 5.16 release candidates (NVD).

The vulnerability stems from an incorrect page free bug in the OptEE driver where the pointer to allocated pages (struct page *page) progresses incorrectly towards the end of allocation. When performing __free_pages(page, order), this results in freeing arbitrary pages instead of the intended ones. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could lead to arbitrary page freeing in the Linux kernel, potentially resulting in system instability, information disclosure, or privilege escalation. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires local access and low privileges to exploit. It was discovered and reported by Patrik Lantz, and the fix was developed by Sumit Garg with reviews from Tyler Hicks (Kernel Patch).

The vulnerability has been fixed in the Linux kernel through a patch that modifies the page pointer handling in the OptEE driver. The fix involves changing how the page array is populated, preventing the incorrect progression of the page pointer. The patch has been merged into various stable kernel branches (Kernel Patch).