CVE-2021-47622: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47622 is a deadlock vulnerability in the Linux kernel's SCSI UFS error handler. The issue was discovered in the Linux kernel versions up to (excluding) 5.15.25 and versions from (including) 5.16 up to (excluding) 5.16.11. The vulnerability occurs when all tags are allocated and the SCSI error handler attempts to handle errors in the UFS subsystem (NVD).

The vulnerability manifests as a deadlock in the error handler when specific conditions are met: all tags are allocated, the SCSI error handler calls ufshcd_eh_host_reset_handler(), which queues work that calls ufshcd_err_handler(), leading to a system lockup. The issue has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-667 (Improper Locking) (NVD, Kernel Patch).

The vulnerability can result in a system deadlock when the UFS error handler is invoked under specific conditions. This can lead to system unavailability and potential denial of service, affecting the normal operation of the storage subsystem (NVD).

The vulnerability requires local access and low privileges to exploit. It can be triggered when the system is under specific conditions involving the UFS storage subsystem's error handling mechanism (NVD).

The issue has been fixed by modifying ufshcd_exec_dev_cmd() to allocate a reserved request. The fix involves reserving a dedicated slot for device commands and adjusting the queue depth accordingly. Users should upgrade to Linux kernel version 5.15.25 or later, or 5.16.11 or later, depending on their kernel series (Kernel Patch).