CVE-2021-47158: 
Linux Debian vulnerability analysis and mitigation

CVE-2021-47158 is a memory leak vulnerability in the Linux kernel's net/dsa/sja1105 driver. The issue was discovered in the sja1105_setup() function, where failure conditions in sja1105_static_config_load(), sja1105_clocking_setup(), or sja1105_devlink_setup() could lead to memory leaks due to improper cleanup. This vulnerability affects Linux kernel versions from 5.2 through 5.10.42, 5.11 through 5.12.9, and 5.13-rc1 through 5.13-rc3 (NVD).

The vulnerability exists in the sja1105_setup() function within the Linux kernel's DSA (Distributed Switch Architecture) driver for the NXP SJA1105 switch. When certain initialization functions fail, the code would return immediately without properly cleaning up allocated resources, resulting in memory leaks. The issue was introduced by two commits: 'net: dsa: sja1105: move devlink param code to sja1105_devlink.c' and 'net: dsa: Introduce driver for NXP SJA1105 5-port L2 switch'. The vulnerability has a CVSS v3.1 base score of 5.5 MEDIUM (NVD, Kernel Patch).

The vulnerability can lead to memory leaks in the Linux kernel when the SJA1105 network switch driver initialization fails. This could potentially result in system resource exhaustion over time, affecting system availability (NVD).

The vulnerability requires local access with low privileges to exploit. The attack complexity is low, but user interaction is not required for exploitation. The scope is unchanged, meaning the impact is limited to the vulnerable component (NVD).

The vulnerability has been fixed by adding proper cleanup paths in the sja1105_setup() function. The fix includes adding cleanup labels (out_devlink_teardown, out_ptp_clock_unregister, out_static_config_free) and ensuring proper resource cleanup when initialization fails. Users should update to Linux kernel versions that include the fix (Kernel Patch).