CVE-2021-47350: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47350 affects the Linux kernel's PowerPC architecture implementation. The vulnerability stems from the kernel's inability to properly handle execution faults from kernel mode. The issue was discovered when the function is_exec_fault() returns 'false' when an execution fault is taken by the kernel, due to the check being based on reading current->thread.regs->trap which contains the trap from user mode (Kernel Git).

The vulnerability occurs because when provoking a LKDTM EXEC_USERSPACE test, current->thread.regs->trap is set to SYSCALL trap (0xc00), and the fault taken by the kernel is not recognized as an execution fault by set_access_flags_filter(). On the PowerPC 603 processor, all upper bits of SRR1 get cleared when the TLB instruction miss handler bails out to ISI. The issue leads to a minor fault because PAGE_EXEC is not set, and set_access_flags_filter() should set PAGE_EXEC. However, since is_exec_fault() returns false, set_access_flags_filter() exits without setting the PAGE_EXEC flag, resulting in an infinite minor execution fault (Kernel Git).

The vulnerability results in a kernel lockup condition when execution faults occur in kernel mode on PowerPC systems. This can lead to system stability issues and potential denial of service conditions (NVD).

The vulnerability requires local access and can be triggered through specific kernel operations. The CVSS base score is 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CISA-ADP).

The issue has been fixed in the Linux kernel through a patch that modifies the bad_kernel_fault() function to fire for any execution fault taken by the kernel, reverting to behavior prior to commit d3ca587404b3. The fix involves removing specific error code checks and treating all execution faults from kernel mode as bad faults (Kernel Git).