CVE-2021-47128: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2021-47128) was discovered related to buggy SELinux lockdown permission checks. The issue was introduced by commit 59438b46471a which implemented SELinux lockdown hooks to restrict domains from performing operations that would breach lockdown. The vulnerability could lead to system crashes through OOM conditions or deadlocks when using BPF tracing tools (Kernel Git).

The vulnerability stems from two main technical issues: 1) Audit events triggered by security_locked_down() calls could cause OOM kills due to audit message flooding, and 2) A deadlock condition via avc_has_perm()/slow_avc_audit() when attempting to wake up kauditd, particularly when using trace_sched_switch() tracepoint. The issue manifested when using common tracing tools like runqlat & runqslower from bcc. Additionally, the SELinux policy rule implementation was broken for BPF, as it incorrectly checked permissions against the 'current' task rather than the entity installing the BPF program (Kernel Git).

The vulnerability could cause system-wide impacts including: 1) Complete system crashes through out-of-memory (OOM) conditions due to audit message flooding, 2) System deadlocks when using common tracing tools, and 3) Incorrect application of SELinux lockdown policies for BPF operations (Kernel Git).

The vulnerability could be triggered through normal usage of common BPF tracing tools, making it relatively easy to encounter in production environments. It was not a hypothetical corner case but could be reproduced using standard tools like runqlat & runqslower from bcc (Kernel Git).

The issue was fixed by moving the security check into the program verification phase where the BPF function prototype is retrieved. This ensures the check happens during program loading rather than execution, preventing both the OOM and deadlock conditions. The fix also properly associates the security context with the entity installing the BPF program rather than the current task (Kernel Git).