CVE-2021-47371: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a memory leak vulnerability (CVE-2021-47371) was discovered in the nexthop notification chain listeners. The issue was identified when syzkaller discovered memory leaks that could be triggered by specific commands involving nexthop addition and device reload operations (Kernel Git).

The vulnerability occurs during the reload flow when mlxsw unregisters its netdevs and then unregisters from the nexthop notification chain. Before unregistering from the notification chain, mlxsw receives delete notifications for nexthop objects using netdevs registered by mlxsw or their uppers, but fails to receive notifications for nexthops using netdevs that are not dismantled during the reload flow. For example, this affects blackhole nexthops that internally use the loopback netdev as their nexthop device. The issue has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (NVD).

The vulnerability results in memory leaks in the kernel, which can lead to increased memory consumption and potential system instability over time. The issue specifically affects the nexthop notification chain listeners and can be triggered during device reload operations.

The vulnerability can be exploited using specific commands: 'ip nexthop add id 1 blackhole' followed by 'devlink dev reload pci/0000:06:00.0'. The attack requires local access with sufficient privileges to execute these networking commands (Kernel Git).

The issue has been fixed by modifying the unregister_nexthop_notifier() function to replay delete notifications for the listener being unregistered, making it symmetric to the registration path and consistent with the netdev notification chain. The fix also includes changes to the VXLAN driver to prevent potential deadlocks by unregistering its nexthop listener without holding RTNL (Kernel Git).