CVE-2021-47534: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's DRM (Direct Rendering Manager) VC4 driver was discovered and assigned CVE-2021-47534. The issue stems from a memory leak in the CRTC (CRT Controller) commit structure that occurs during every commit operation. This vulnerability was introduced by commit 9ec03d7f1ed3 which implemented a global state for the HVS (Hardware Video Scaler) with FIFO storage for CRTC commits to synchronize operations (Kernel Commit).

The vulnerability is caused by incorrect reference counting in the DRM VC4 KMS (Kernel Mode Setting) driver. When implementing FIFO storage for CRTC commits, the code failed to properly release the drm_crtc_commit structure after use, resulting in a memory leak during each commit operation. The issue was assigned a CVSS 3.1 base score of 4.1 MEDIUM (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) by CISA-ADP (NVD).

The primary impact of this vulnerability is a memory leak in the Linux kernel's DRM subsystem, which could lead to resource exhaustion over time. Each graphics commit operation would fail to free the associated commit structure, gradually consuming system memory (Kernel Commit).

The vulnerability requires local access with high privileges to exploit, as indicated by the CVSS metrics (AV:L/AC:H/PR:H). The high complexity and privilege requirements make this vulnerability relatively difficult to exploit in practice (NVD).

The vulnerability was fixed by adding a missing drm_crtc_commit_put call to properly release the commit structure after use. The fix was implemented in commit 049cfff8d53a30cae3349ff71a4c01b7d9981bc2 and later backported to stable kernel versions. Users should update their Linux kernel to a version containing this fix (Kernel Commit).