CVE-2021-47401: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's ipack/ipoctal driver has been identified where the tty driver name is allocated on the stack and used after registering the driver. This could lead to information leakage to user space or potentially trigger an oops condition. The vulnerability was discovered in 2021 and assigned CVE-2021-47401 (NVD).

The vulnerability exists in the ipoctal driver's implementation where topology information is encoded in the tty device name using a stack-allocated buffer. The issue occurs because the tty driver name continues to be used after driver registration, but the buffer is allocated on the stack, which can lead to information leakage. The vulnerability was introduced when the IP-OCTAL mezzanine board support was added to the staging area (Kernel Commit).

This vulnerability could allow an attacker to access sensitive information from kernel memory that may be leaked through the stack-allocated buffer. Additionally, it could potentially trigger a system crash (oops condition) due to accessing invalid memory after the stack frame is destroyed (NVD).

The vulnerability requires local access to a system running the affected Linux kernel version with the ipack/ipoctal driver. The issue can be triggered through normal interaction with the tty device interface (Kernel Commit).

The vulnerability has been fixed by allocating the tty driver name using kasprintf(GFP_KERNEL) instead of using a stack buffer. The fix ensures proper memory management and prevents information leakage. Users should update to a patched kernel version that includes the security fix (Kernel Commit).