CVE-2021-47297: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47297 is a vulnerability in the Linux kernel's CAIF (Communication CPU to Application CPU Interface) socket implementation. The issue was discovered in the caif_seqpkt_sendmsg function where an uninitialized value could be accessed when nr_segs equals zero in iovec_from_user. The vulnerability was disclosed in May 2024 and affects the Linux kernel's networking subsystem (NVD).

The vulnerability exists in the caif_seqpkt_sendmsg function within net/caif/caif_socket.c. When nr_segs equals zero in iovec_from_user, the object msg->msg_iter.iov contains uninitialized stack memory which is defined in ___sys_sendmsg. The code incorrectly attempted to access msg->msg_iter.iov->base directly without checking if nr_segs was zero first. The CVSS v3.1 base score is 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Kernel Git).

The vulnerability could lead to a system crash due to accessing uninitialized memory, potentially causing a denial of service condition. The issue affects the kernel's networking stack, specifically the CAIF protocol implementation (CISA-ADP).

The vulnerability requires local access and low privileges to exploit. It can be triggered through the sendmsg system call when using CAIF sockets with specific conditions. The bug was discovered through the Syzkaller kernel fuzzer, as evidenced by the bug report (Kernel Git).

The vulnerability has been fixed by adding an additional check for msg->msg_iter.nr_segs before accessing the iov base pointer. The fix involves modifying the condition to check both nr_segs and iov_base: 'if (unlikely(msg->msg_iter.nr_segs 0) || unlikely(msg->msg_iter.iov->iov_base NULL))' (Kernel Git).