CVE-2021-47603: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47603 affects the Linux kernel's audit subsystem. The vulnerability was discovered when the audit daemon could get stuck in a stopped state, causing the kernel's kauditd_thread() to become blocked while attempting to send audit records to the userspace audit daemon (NVD).

The vulnerability stems from the kernel thread being blocked with MAX_SCHEDULE_TIMEOUT when sending audit records, which could lead to unbounded growth of the audit queue since certain audit record generating events must be exempt from queue limits to prevent system deadlock. The vulnerability has a CVSS v3.1 Base Score of 4.4 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) (NVD).

When exploited, this vulnerability could cause the audit queue to grow unbounded when the audit daemon is stopped and the system is under heavy audit pressure. This could potentially lead to system performance degradation and resource exhaustion (Kernel Patch).

The vulnerability requires local access and high privileges (root access would be needed to send SIGSTOP to the audit daemon). The scope of exploitation is limited due to these requirements (NVD).

The vulnerability was patched by lowering the kernel thread's socket sending timeout from MAX_SCHEDULE_TIMEOUT to HZ/10 and modifying the kauditd_send_queue() function to better manage audit queues during connection problems. With this fix, while the backlog may temporarily exceed defined limits when the audit daemon is stopped, the kauditd_thread() will continue to make progress and drain the queues (Kernel Patch).