CVE-2021-47221: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47221 affects the Linux kernel's SLUB memory allocator. The vulnerability was discovered in the mm/slub component where SLUB redzoning ("slub_debug=Z") checks from s->object_size rather than from s->inuse (which is normally bumped to make room for the freelist pointer). This causes a cache created with an object size less than 24 bytes to have the freelist pointer written beyond s->object_size, resulting in redzone corruption by the freelist pointer (Kernel Git).

The vulnerability occurs in the SLUB memory allocator's redzoning functionality. When using slub_debug=Z, the system checks object boundaries from s->object_size instead of s->inuse. For caches with object sizes less than 24 bytes, this causes the freelist pointer to be written beyond the object's allocated size, corrupting the redzone memory area. The issue becomes particularly visible when using slub_debug=ZF, where it triggers a "Right Redzone overwritten" bug report (Kernel Git).

While no caches in this size range were known to exist in the kernel at the time of discovery, the vulnerability could potentially lead to memory corruption through redzone overwriting. This could affect system stability and potentially be exploited for security breaches in specific configurations using SLUB debugging features (Kernel Git).

The vulnerability requires specific conditions to be exploited, namely the use of SLUB debugging features (slub_debug=Z) and allocation of objects smaller than 24 bytes. No known exploits have been reported in the wild (NVD).

The issue was fixed by adjusting the offset to stay within s->object_size and modifying how the freelist pointer location is calculated. The fix involves removing the freepointer_area variable and using ALIGN_DOWN on s->object_size/2 instead of the previous calculation method (Kernel Git).