CVE-2021-47141: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47141 is a vulnerability in the Linux kernel's Generic Virtual Ethernet (gve) driver. The issue was discovered and disclosed on March 25, 2024, affecting various Linux kernel versions from 5.3 through 5.13-rc3. The vulnerability involves a NULL pointer dereference that occurs when freeing notification blocks in the gve driver (NVD, Red Hat).

The vulnerability occurs when indexing priv->msix_vectors during the freeing of notification blocks. If priv->msix_vectors fails to allocate (in abort_with_msix_vectors), it could lead to a NULL pointer dereference when the driver is unloaded. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-476 (NULL Pointer Dereference) (NVD).

The vulnerability can lead to a system crash if exploited when the driver is unloaded, affecting system availability. The impact is limited to local attacks and requires low privileges to execute. There are no confidentiality or integrity impacts associated with this vulnerability (NVD, Red Hat).

The vulnerability requires local access and low privileges to exploit. The attack complexity is rated as low, indicating that the exploitation is straightforward once local access is obtained. No user interaction is required for exploitation (NVD).

The vulnerability has been patched by adding NULL pointer checks when freeing IRQs in the gve driver. The fix involves checking if priv->msix_vectors exists before attempting to free the IRQs. Multiple Linux distributions have released updates containing the fix, including Ubuntu and Red Hat. Users are advised to update their systems to the patched versions (Kernel Patch).