LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47147: ptp: ocp: Fix a resource leak in an error handling path

In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix a resource leak in an error handling path If an error occurs after a successful 'pci_ioremap_bar()' call, it must be undone by a corresponding 'pci_iounmap()' call, as already done in the remove function.

MediumCVSS 6.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a resource leak in the PTP OCP driver error path. It does not indicate data theft or tampering. The rated impact is availability: under affected conditions, local interaction with a vulnerable kernel could contribute to a denial-of-service condition.

Executive priority

Treat as a moderate availability issue. Prioritize patching on Linux systems that use PTP OCP hardware or specialized timing infrastructure, but this is not supported as a data breach or active exploitation emergency by the supplied sources.

Technical view

The ptp_ocp PCI driver failed to call pci_iounmap() after a successful pci_ioremap_bar() when later initialization errors occurred. The kernel fix aligns cleanup with the remove path. CVSS is 6.2 with local attack vector and high availability impact only.

Likely exposure

Exposure is most likely on Linux systems running affected kernel versions with the PTP OCP PCI driver or related hardware in use. Systems without the driver or hardware are less likely to be practically exposed, but kernel package status should drive decisions.

Exploitation context

The bundle does not cite active exploitation, and KEV is false. The CVSS vector is local, low complexity, no privileges, no user interaction, with availability impact only. Public evidence provided does not describe a real-world exploit.

Researcher notes

Evidence supports a kernel driver cleanup flaw, not a confidentiality or integrity issue. The source bundle names affected Linux versions and two stable commits, but does not provide exploit details, operational triggers, or distribution-specific fixed package versions.

Mitigation direction

  • Apply Linux kernel updates that include the referenced stable fixes.
  • Check distribution or vendor advisories for fixed kernel packages.
  • Prioritize systems using PTP OCP PCI hardware or the ptp_ocp driver.
  • If updates are unavailable, follow vendor guidance for temporary exposure reduction.

Validation and detection

  • Inventory Linux kernel versions across affected fleets.
  • Confirm whether ptp_ocp support is present, loaded, or required.
  • Check kernel changelogs for the referenced stable commits.
  • Validate vendor package status before closing remediation tickets.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47147 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.2CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

6.2Medium
CVSS 3.1 vector shape for CVE-2021-47147Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa7e1abad13f3f0366ee625831fecda2b603cdc17, a7e1abad13f3f0366ee625831fecda2b603cdc17unaffected
LinuxLinux5.11, 0, 5.12.9, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.