CVE-2021-47397: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47397 affects the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. The vulnerability was discovered in the sctp_rcv_ootb function where a NULL pointer dereference could occur when skb_header_pointer returns NULL. This vulnerability affects Linux kernel versions from 4.8 up to (excluding) 5.10.71 (NVD).

The vulnerability exists in the sctp_rcv_ootb function within net/sctp/input.c. The issue occurs because the code fails to check if skb_header_pointer's return value is NULL before dereferencing it. The CVSS v3.1 base score is 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-476 (NULL Pointer Dereference) (NVD).

If exploited, this vulnerability could lead to a null pointer dereference, potentially causing a kernel crash or denial of service condition. The issue affects the system's SCTP networking functionality (NVD).

The vulnerability requires local access with low privileges to exploit. It was discovered through automated testing using syzkaller, as evidenced by the crash report showing the null pointer dereference in the SCTP processing path (Kernel Patch).

The vulnerability has been fixed in the Linux kernel by adding a NULL check before using the return value of skb_header_pointer. The fix was implemented through patches in various kernel versions. Users should update to patched kernel versions that include the fix (Kernel Patch).