CVE-2021-47327: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47327 is a reference counting vulnerability in the Linux kernel's ARM SMMU (System Memory Management Unit) driver. The issue was discovered in the arm_smmu_rpm_get() function, which incorrectly handles error cases leading to potential reference count leaks. The vulnerability was disclosed in May 2024 and affects the Linux kernel's IOMMU subsystem (NVD).

The vulnerability occurs when arm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the refcount of the 'smmu' device even when the return value is less than 0. In error handling paths, the caller functions fail to decrease the refcount of 'smmu' that was increased by arm_smmu_rpm_get(), resulting in a reference count leak. The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (NVD).

The reference counting issue can lead to resource leaks in the system's memory management unit, potentially affecting system stability and security. The high CVSS score indicates significant potential for unauthorized information disclosure and system availability impacts (NVD).

The vulnerability requires local access with low privilege levels and no user interaction for exploitation. The attack complexity is considered low, making it relatively straightforward to exploit if an attacker has the necessary local access (NVD).

The vulnerability has been fixed by replacing pm_runtime_get_sync() with pm_runtime_resume_and_get() in the arm_smmu_rpm_get() function. This change ensures proper reference counting balance in case of failures. The fix has been implemented in the Linux kernel codebase (Kernel Patch).