CVE-2021-47364: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47364 affects the Linux kernel's comedi driver, specifically in the compat_insnlist() function. The vulnerability was discovered in September 2021 and involves a memory leak in the handling of the 32-bit version of the COMEDI_INSNLIST ioctl when CONFIG_COMPAT is enabled (Kernel Commit).

The vulnerability occurs in the compat_insnlist() function which handles the 32-bit version of the COMEDI_INSNLIST ioctl. The function allocates memory to temporarily hold an array of struct comedi_insn converted from the 32-bit version in user space. The issue arises because this memory is only freed if there is a fault while filling the array, otherwise it remains allocated, causing a memory leak (Kernel Commit).

The vulnerability results in a memory leak in the Linux kernel's comedi driver. Each time the affected ioctl is called without encountering a fault, it leaks memory that is not properly freed, potentially leading to resource exhaustion over time (Kernel Commit).

The vulnerability requires local access to the system and the ability to make COMEDI_INSNLIST ioctl calls to the affected driver. The issue is triggered specifically when using 32-bit applications on 64-bit systems with CONFIG_COMPAT enabled (Kernel Commit).

The vulnerability has been fixed by adding a call to kfree(insns) before returning from the compat_insnlist() function. The fix was implemented in the Linux kernel and is tracked back to the commit that introduced the issue: b8d47d881305 (Kernel Commit).