CVE-2021-47631: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, CVE-2021-47631 addresses a NULL pointer dereference vulnerability in the da850_evm_config_emac() function. The issue occurs when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine with newer versions of GCC. The vulnerability exists because davinci_soc_info only gets populated on davinci machines, but da850_evm_config_emac() is called on all machines via device_initcall() (Kernel Git).

The vulnerability is triggered when the emac_pdata pointer in soc_info is NULL, causing a kernel panic when attempting to access rmii_en. The issue manifests as a NULL pointer dereference at virtual address 00000020, resulting in an internal error (Oops: 5) on ARM systems. The problem stems from improper ordering of operations where rmii_en is accessed before verifying if the current machine is a supported SoC (Kernel Git).

When triggered, this vulnerability causes a kernel panic, leading to a system crash. This results in a denial of service condition on affected systems running the vulnerable kernel version (Kernel Git).

The vulnerability is triggered during system boot when using specific configurations (multi_v5_defconfig) in QEMU under the palmetto-bmc machine. It requires no special privileges to trigger, as it occurs during the normal boot process (Kernel Git).

The fix involves moving the rmii_en assignment below the machine check so that it is only dereferenced when running on a supported SoC. This ensures that the pointer is only accessed after verifying the correct machine type (Kernel Git).