CVE-2021-47373: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47373 affects the Linux kernel's GIC-v3 ITS (Generic Interrupt Controller version 3 Interrupt Translation Service) component. The vulnerability was discovered in the irqchip/gic-v3-its subsystem, specifically related to a potential Virtual Processing Element (VPE) leak on error condition. The issue was disclosed on May 21, 2024, and affects Linux kernel versions from 4.14 through 5.15-rc2 (NVD).

The vulnerability stems from an off-by-one error in the its_vpe_irq_domain_alloc function when its_vpe_init() returns an error. The bug occurs in the number of VPEs to be freed, where the code incorrectly calculates the number of VPEs that need to be deallocated during error handling. The CVSS v3.1 base score is 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a Virtual Processing Element (VPE) leak in the system when error conditions occur during VPE allocation. This could potentially result in resource exhaustion and affect system availability (NVD).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is needed for exploitation. There are no known reports of this vulnerability being exploited in the wild (NVD).

The issue has been fixed by modifying the VPE deallocation logic to correctly pass the number of VPEs allocated during error handling. The fix involves changing its_vpe_irq_domain_free to use the actual number of allocated VPEs instead of subtracting one from the count. Multiple Linux distributions have released patches, including Ubuntu for various kernel versions and Red Hat Enterprise Linux (Kernel Patch).