CVE-2021-47097: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47097 is an out-of-bounds (OOB) stack memory access vulnerability discovered in the Linux kernel's elantech module, specifically in the elantech_change_report_id function within drivers/input/mouse/elantech.c. The vulnerability was publicly disclosed and fixed in late 2021 (Red Hat Portal).

The vulnerability occurs due to a buffer size mismatch where the param[] array in elantech_change_report_id() is defined as an array of 2 bytes, but elantech_read_reg_params() calls ps2_command() with PSMOUSE_CMD_GETINFO which requires access to 3 bytes. This mismatch leads to a potential stack out-of-bounds access, which was confirmed by KASAN (Kernel Address Sanitizer) (Kernel Commit).

This vulnerability allows a local attacker with system access to potentially crash the system or leak kernel internal information, compromising system stability and potentially exposing sensitive kernel data (Red Hat Portal).

The vulnerability requires local access to the system and can be triggered through the elantech mouse driver. The CVSS base score is 6.0, indicating moderate severity with local attack vector and low attack complexity (Red Hat Portal).

The vulnerability was fixed by modifying the param[] array size in elantech_change_report_id() to be 3 bytes instead of 2 bytes. The fix has been incorporated into various Linux kernel versions through security updates. System administrators should apply the appropriate kernel updates to mitigate this vulnerability (Kernel Commit).