CVE-2021-47391: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47391 is a vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) Connection Manager component. The vulnerability was discovered in 2021 and involves a race condition in the address resolution process. Specifically, the issue occurs when rdma_resolve_ip() can be called twice on the same id_priv, violating the invariant that the same address resolution background request cannot be active twice (Kernel Git).

The vulnerability stems from a Finite State Machine (FSM) race condition where rdma_resolve_ip() can be called twice on the same id_priv. The issue manifests when the FSM runs in a circle, allowing multiple address resolution background requests to be active simultaneously. This creates a situation where the req_list can have two requests for the same handle, but rdma_addr_cancel() only cancels the first one, leaving the second request active beyond rdma_destroy_id() (Kernel Git).

The vulnerability can lead to a use-after-free condition when the second request remains active beyond rdma_destroy_id() and attempts to access the freed id_priv structure. This could potentially result in memory corruption and system instability (Kernel Git).

The vulnerability requires specific timing conditions to be met and cannot happen without going through the work queue, though it violates the invariant that the same address resolution background request cannot be active twice (Kernel Git).

The issue has been fixed by implementing a tracking mechanism to remember if id_priv has called rdma_resolve_ip() and ensuring rdma_addr_cancel() is called before issuing new requests. This ensures the req_list never gets more than one item in it. The fix was implemented in the Linux kernel through a patch that adds a new used_resolve_ip flag to track the state (Kernel Git).