CVE-2021-47172: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2021-47172) was discovered in the AD7124 ADC driver. The issue relates to potential overflow due to non-sequential channel numbers in the iio:adc:ad7124 component. The vulnerability was discovered in May 2021 and has been resolved through a patch. The issue affects the Linux kernel's Industrial I/O subsystem, specifically the Analog Devices AD7124 ADC driver (Kernel Git).

The vulnerability occurs when channel numbering doesn't start at 0 or contains gaps, which can lead to overflow of the available storage. This issue was introduced as part of a fix to ensure the driver didn't rely on the ordering of child nodes. The problem manifests in the ad7124_of_parse_channel_config function where insufficient validation of channel numbers could allow an index to exceed the allocated array bounds (Kernel Git).

If exploited, this vulnerability could lead to a buffer overflow condition, potentially resulting in memory corruption. The issue affects systems using the AD7124 ADC driver in the Linux kernel (Kernel Git).

The vulnerability requires access to configure the device tree or system configuration for the AD7124 ADC. It was discovered during testing with QEMU, suggesting it can be triggered through normal system configuration operations (Kernel Git).

The issue has been fixed by adding validation checks to ensure channel numbers don't exceed the available number of channels. The fix was implemented through a patch that adds explicit bounds checking before processing channel configurations (Kernel Git).