CVE-2021-47482: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47482 is a vulnerability in the Linux kernel's batman-adv (Batman Advanced) mesh networking protocol implementation. The issue was discovered when Syzbot reported an ODEBUG warning in batadv_nc_mesh_free(). The vulnerability stems from incorrect error handling in batadv_mesh_init(), where the function was calling batadv_mesh_free() in case of any batadv_*_init() calls failure without proper initialization checks (NVD).

The vulnerability occurs due to wrong error handling in batadv_mesh_init(). When batadv_mesh_init() encounters a failure in any of the batadv_*_init() calls, it calls batadv_mesh_free() without having any indicator to determine which parts of batadv are initialized. This leads to cleaning up uninitialized fields. Even when hiding the ODEBUG warning by initializing bat_priv->nc.work, a General Protection Fault (GPF) could still occur in batadv_nc_purge_paths() because the hash pointer remains NULL (Kernel Commit).

The vulnerability could lead to a denial of service condition through a kernel crash. When exploited, it could cause system instability due to improper memory handling and potential General Protection Faults. The CVSS Base Score is 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability requires low privileges but high attack complexity to exploit. It primarily affects systems using the Batman Advanced mesh networking protocol in the Linux kernel. No known exploits have been reported in the wild.

The vulnerability has been patched by modifying the error handling approach. The fix involves unwinding batadv_init() calls one by one, which both fixes the bugs in the error handling path and improves performance by avoiding unnecessary batadvfree() function calls. The patch ensures all batadv*_init() functions clean up allocated memory before returning with an error (Kernel Commit).