CVE-2021-47618: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47618 affects the Linux kernel and involves a vulnerability in the ARM architecture when both KASAN (Kernel Address Sanitizer) and Kprobe features are enabled. The issue was discovered and disclosed in June 2024, specifically impacting ARM32 systems that utilize software simulation for instructions replaced by Kprobe (NVD).

The vulnerability occurs when ARM32 uses software to simulate instructions replaced by Kprobe. The issue arises because when KASAN is enabled, it disrupts the register binding relationship necessary for instruction simulation. This occurs specifically in three files: actions-common.c, actions-arm.c, and actions-thumb.c. The problem manifests when constructing assembly function execution environments in C language through binding registers (Kernel Commit).

When exploited, this vulnerability results in a kernel panic due to instruction simulation errors. Specifically, it can lead to a NULL pointer dereference at virtual address 00000090, causing an internal error (Oops: 206) in SMP ARM systems (Kernel Commit).

The vulnerability is triggered when using Kprobe insert on cap_capable+20 after KASAN is enabled. The issue manifests during the execution of the emulate_ldr instruction simulation, leading to a kernel panic (Kernel Commit).

The fix involves disabling KASAN when compiling the affected files (actions-common.c, actions-arm.c, and actions-thumb.c) by adding KASAN_SANITIZE flags in the Makefile. This solution was implemented through a patch that fixes both the ARM kprobes instruction single-stepping support and KASan for ARM issues (Kernel Commit).