CVE-2021-47147

What it actually does

Missing pci_iounmap() call in error path after successful pci_ioremap_bar() in ptp ocp driver causes resource leak.

Why it matters to the business

Gradual resource exhaustion possible on affected systems leading to reduced stability; low urgency given false KEV status, stable low EPSS, and 939 days since publication; impacts AlmaLinux 8 nss package ecosystem with prevalence in dependent environments.

How an attack unfolds

An attacker triggers an error condition after pci_ioremap_bar() succeeds in the ptp ocp initialization path, leaving the mapping active and leaking resources; repeated triggering could exhaust mappings or related kernel resources.

How to fix it

Upgrade affected AlmaLinux 8 packages to the listed fixed versions: nss, nss-devel, nss-softokn, nss-softokn-devel, nss-softokn-freebl, nss-softokn-freebl-devel, nss-sysinit, nss-tools, nss-util, and nss-util-devel all to 3.67.0-7.el8_5.

How to confirm the fix worked

Confirm installed package versions meet or exceed the fixed releases and review driver code or runtime behavior for proper unmap calls on all error paths.

Typical attack path

1. Identify or induce error condition post pci_ioremap_bar() in ptp ocp driver
2. Allow error handling path to execute without unmap
3. Repeat to accumulate leaks and exhaust resources

How to detect it

Review kernel logs for ptp ocp initialization errors, track PCI mapping counts or memory usage trends over time, and correlate with process activity involving the driver.

What your security team should do

• Apply the specified package updates immediately across all AlmaLinux 8 systems
• Audit systems for ptp ocp usage and monitor resource consumption post-update
• Incorporate kernel driver error path reviews into future secure development practices