CVE-2021-47257: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47257 affects the Linux kernel's IEEE 802.15.4 networking implementation. The vulnerability was discovered and disclosed on May 21, 2024, involving a logic error in the parse_dev_addr function that could result in a null pointer dereference if the user sets the mode incorrectly for the given address type (NVD).

The vulnerability exists in the net/ieee802154/nl802154.c file where a logic error in the ieee802154_llsec_parse_dev_addr function could lead to a null pointer dereference. The issue occurs when validating device address attributes, specifically when handling the mode setting for short or extended addresses (Kernel Commit). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

The vulnerability can lead to a null pointer dereference, which typically results in a system crash or denial of service condition. The impact is limited to local attacks and requires low privileges to exploit (Red Hat).

The vulnerability requires local access and low privileges to exploit. There is no evidence of this vulnerability being exploited in the wild based on available information (NVD).

The vulnerability has been fixed in various Linux kernel versions. Patches have been released for affected distributions including Ubuntu 20.04 LTS (5.4.0-81.91), Ubuntu 18.04 LTS (4.15.0-156.163), and Red Hat Enterprise Linux (Ubuntu, Red Hat). Users are advised to update their kernel to the patched versions.