CVE-2021-47337: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47337 addresses a NULL pointer dereference vulnerability in the Linux kernel's SCSI subsystem. The issue was introduced by commit 66a834d09293 which changed the allocation logic in scsi_host_alloc() but failed to properly handle error cases when the error handler thread fails to spawn (NVD).

The vulnerability occurs in the SCSI core subsystem when the error handler thread fails to spawn during host initialization. In such cases, shost->ehandler is set to ERR_PTR(-ENOMEM), but the cleanup code in scsi_host_dev_release() attempts to call kthread_stop() if shost->ehandler is non-NULL. This leads to dereferencing an invalid pointer since the error handler thread was never successfully created. The issue manifests as a kernel NULL pointer dereference at address 0x0000010c (Kernel Patch).

When triggered, this vulnerability results in a kernel panic due to NULL pointer dereference, which can lead to system crashes and potential denial of service conditions. The issue affects systems using the SCSI subsystem, particularly during device initialization or cleanup phases (NVD).

The vulnerability can be triggered during SCSI host allocation when the error handler thread fails to spawn. It has been observed in the wild particularly with IBM virtual SCSI devices, as demonstrated by the crash logs showing the issue occurring during ibmvscsi driver initialization (Kernel Patch).

The issue has been fixed by nulling shost->ehandler when the kthread fails to spawn, preventing the invalid pointer dereference during cleanup. The fix was implemented in the Linux kernel through a patch that adds a single line of code to set shost->ehandler to NULL in the error path (Kernel Patch).