CVE-2021-47287: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47287 is a memory leak vulnerability in the Linux kernel's auxiliary bus driver core. The issue was discovered in Linux kernel versions from 5.11 through 5.13.6, and also affects 5.14-rc1 and 5.14-rc2. The vulnerability occurs when driver_register() fails, where the memory allocated for auxdrv->driver.name is not properly freed before returning from __auxiliary_driver_register() (NVD).

The vulnerability is caused by a missing memory deallocation in the auxiliary bus driver core. When the driver_register() function returns with an error, the memory that was allocated for auxdrv->driver.name is not freed, resulting in a memory leak. The issue was introduced in commit 7de3697e9cbd4 "Add auxiliary bus support" and was fixed by adding proper memory cleanup in the error path. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to memory leaks in the Linux kernel when auxiliary driver registration fails. This could potentially result in system resource exhaustion over time, affecting system availability. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there can be a high impact on system availability (NVD).

The vulnerability requires local access with low privileges to exploit. The attack complexity is low, and no user interaction is required. However, the attacker needs to have local access to the system and sufficient privileges to interact with the kernel's driver registration mechanism (NVD).

The vulnerability has been fixed in the Linux kernel through a patch that properly frees the allocated memory when driver_register() fails. The fix was implemented in commit 4afa0c22eed33cfe0c590742387f0d16f32412f3 and backported to stable kernel versions. Users should update their Linux kernel to a patched version to mitigate this vulnerability (Kernel Patch).