CVE-2021-47198: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47198 is a use-after-free vulnerability discovered in the Linux kernel's SCSI lpfc driver. The vulnerability was disclosed and patched in late 2021, affecting Linux kernel versions up to (excluding) 5.15.5. The issue occurs in the lpfc_unreg_rpi() routine of the lpfc driver when unloading the driver (NVD, Kernel Patch).

The vulnerability stems from a flag management issue where the NLP_REG_LOGIN_SEND nlp_flag is set in lpfc_reg_fab_ctrl_node() but not cleared upon login completion. This allows a second call to lpfc_unreg_rpi() to proceed with nlp_rpi set to LPFC_RPI_ALLOW_ERROR, resulting in a use-after-free condition when used as an rpi_ids array index. The issue is detected with the error message "KASAN: use-after-free in lpfc_unreg_rpi+0x1b1b". The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially lead to system crashes, memory corruption, or privilege escalation due to the use-after-free condition in the kernel's SCSI driver. This could affect systems using the lpfc driver for Fibre Channel host bus adapter support (NVD).

The vulnerability requires local access and can be triggered when unloading the lpfc driver. No known exploits in the wild have been reported (NVD).

The vulnerability has been fixed by clearing the NLP_REG_LOGIN_SEND nlp_flag in lpfc_mbx_cmpl_fc_reg_login(). Users should upgrade to Linux kernel version 5.15.5 or later which contains the fix. The patch has been backported to stable kernel trees (Kernel Patch).