CVE-2021-47171: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47171 is a memory leak vulnerability in the Linux kernel's smsc75xx_bind() function, discovered by Syzbot. The vulnerability was disclosed on March 25, 2024, affecting Linux kernel versions from 2.6.34 up to versions before 4.4.271, 4.9.271, 4.14.235, 4.19.193, 5.4.124, 5.10.42, and 5.12.9 (NVD).

The vulnerability occurs due to non-freed memory in case of errors after memory allocation in the smsc75xx_bind() function within the Linux kernel's USB networking driver. The issue manifests in the backtrace at include/linux/slab.h:556 [inline] for kmalloc and include/linux/slab.h:686 [inline] for kzalloc, specifically in drivers/net/usb/smsc75xx.c:1460 and drivers/net/usb/usbnet.c:1728. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The memory leak vulnerability can lead to resource exhaustion in the affected systems, potentially impacting system availability. The CVSS score indicates that while the vulnerability requires local access and low privileges, it can have a high impact on system availability (NVD).

The vulnerability requires local access with low privileges to exploit. No known exploits in the wild have been reported at the time of disclosure (NVD).

The vulnerability has been fixed in the Linux kernel through patches that properly free memory in error cases. Multiple stable kernel versions have received the fix, including updates for Ubuntu 20.04 LTS (5.4.0-80.90), 18.04 LTS (4.15.0-151.157), and 16.04 LTS (4.4.0-258.292) (Ubuntu). Users should update their systems to the patched versions.