| The CVE-2021-47373 vulnerability is a potential memory leak in the Linux kernel's irqchip/gic-v3-its component. Specifically, the issue occurs in the `its_vpe_irq_domain_alloc` function when `its_vpe_init()` returns an error. In this scenario, there is an off-by-one error in the number of VPEs (Virtual Processor Elements) to be freed. |
| |
| The root cause of the problem lies in the incorrect calculation of the number of VPEs allocated, which is used as the index for a loop iterating over the VPEs. To fix this issue, the corrected code simply passes the actual number of VPEs allocated, ensuring that all allocated resources are properly released in case of an error. |
| |
| This vulnerability was introduced in Linux kernel version 4.14 with commit 7d75bbb4bc1a and has been fixed in various subsequent kernel versions, including 4.14.249, 4.19.209, 5.4.150, 5.10.70, 5.14.9, and 5.15. The affected file is `drivers/irqchip/irq-gic-v3-its.c`. |
| |
