CVE-2021-47341: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability has been identified in the Linux kernel's KVM (Kernel-based Virtual Machine) component, specifically in the coalesced MMIO (Memory-Mapped I/O) functionality. The vulnerability, tracked as CVE-2021-47341, occurs in the kvm_vm_ioctl_unregister_coalesced_mmio function when handling MMIO device unregistration. This issue affects Linux kernel versions from 5.4.119 up to (but not including) 5.4.134, 5.10.37 up to 5.10.52, 5.11.21 up to 5.12, and 5.12.4 up to 5.12.19 (NVD).

The vulnerability is triggered when kvm_io_bus_unregister_dev() returns -ENOMEM, causing a double-free condition. In this scenario, kvm_iodevice_destructor() is called inside the function to delete the 'struct kvm_coalesced_mmio_dev *dev' from the list and free the device, but kvm_iodevice_destructor() is erroneously called again, leading to a use-after-free condition. The issue manifests as a read of size 8 at a freed memory location. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially lead to privilege escalation, information disclosure, or system crashes in environments using KVM virtualization. The high CVSS score indicates that successful exploitation could result in a complete compromise of confidentiality, integrity, and availability of the affected system, though local access is required (NVD).

The vulnerability requires local access and low privileges to exploit. It can be triggered through the KVM IOCTL interface when handling MMIO device unregistration operations. The issue was discovered and reported by Hulk Robot (Kernel Patch).

The vulnerability has been fixed by modifying the code to check the return value of kvm_io_bus_unregister_dev() and only call kvm_iodevice_destructor() if the return value is 0. The fix has been implemented in the Linux kernel through a patch that corrects the double-free condition. Users should upgrade to patched kernel versions to mitigate this vulnerability (Kernel Patch).