CVE-2021-47178: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2021-47178) was identified in the SCSI target core component. The issue involves the improper use of smp_processor_id() in preemptible code, which could lead to system instability. The vulnerability was discovered when running blktests block/005 on TCMU devices with fileio backend or user:zbc backend (KERNEL GIT).

The vulnerability occurs when smp_processor_id() is called in preemptible code sections, specifically in the SCSI host work queue for abort handling. This was triggered by commit 1130b499b4a7 which modified work queue handling of commands and changed 'current->nr_cpu_allowed' at smp_processor_id() call. The issue has been assigned a CVSS v3.1 base score of 5.5 with the vector string (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (CISA).

The vulnerability could result in system instability and potential denial of service conditions when running in preemptible code contexts. This particularly affects systems using TCMU devices with kernel config DEBUG_PREEMPT enabled (KERNEL GIT).

The vulnerability requires local access and low attack complexity to exploit. It primarily affects systems running specific SCSI target configurations with preemptible kernel settings (CISA).

The vulnerability has been fixed by replacing smp_processor_id() with raw_smp_processor_id() in the affected code. This change avoids the preemptible code check while maintaining the intended functionality for CPU ID usage in performance improvement (KERNEL GIT).