CVE-2021-47345: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47345 is a memory leak vulnerability discovered in the Linux kernel's RDMA/cma (Remote Direct Memory Access/Connection Manager Agent) subsystem. The vulnerability was disclosed on May 21, 2024, affecting multiple versions of the Linux kernel. The issue occurs specifically in the rdma_resolve_route() function when it is called more than once on the same rdma_cm_id (NVD).

The vulnerability stems from a memory leak in the RDMA/cma subsystem when rdma_resolve_route() is called multiple times on the same rdma_cm_id. This scenario can occur when cma_query_handler() triggers the RDMA_CM_EVENT_ROUTE_ERROR flow, which resets the state machine and allows rdma_resolve_route() to be called again. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to memory leaks in the Linux kernel, potentially causing system resource depletion over time. The CVSS scoring indicates that while the vulnerability requires local access and low privileges, it can have a high impact on system availability (Red Hat).

The vulnerability requires local access with low privileges to exploit. The attack complexity is low, requiring no user interaction. The vulnerability has been classified as CWE-401 (Missing Release of Memory after Effective Lifetime) (NVD).

The vulnerability has been fixed in the Linux kernel through a patch that checks if route->path_rec exists before allocating memory. Multiple Linux distributions have released updates to address this vulnerability. The fix involves modifying the memory allocation logic in the rdma_resolve_route() function to prevent multiple allocations (Kernel Patch).