Security readout for executives and security teams
Plain-English summary
CVE-2021-47231 is a Linux kernel memory leak in the mcba_usb SocketCAN driver for the Microchip CAN BUS Analyzer Tool. Repeated device use or disconnect handling could consume kernel memory and affect availability. The source bundle does not report data theft, privilege escalation, or active exploitation.
Executive priority
Treat as a targeted availability risk, not a broad internet emergency. Patch during normal kernel maintenance, faster for systems where local users or devices are less controlled and CAN tooling is operationally important.
Technical view
mcba_usb_start() allocated 20 USB coherent buffers, but disconnect handling killed URBs without explicitly freeing those buffers. Because URB_FREE_BUFFER cannot be used for coherent buffers, the fix frees them with usb_free_coherent(). CVSS is 5.5: local, low complexity, low privileges, availability impact only.
Likely exposure
Exposure is most likely on Linux systems with affected kernel versions and the mcba_usb driver used with Microchip CAN BUS Analyzer hardware. General servers without this driver or hardware path are less likely exposed, but embedded, automotive, industrial, or lab systems using SocketCAN need review.
Exploitation context
The bundle cites syzbot reporting kmemleak findings after device disconnect. KEV is false, and the provided sources do not claim active exploitation or public weaponization. Practical abuse appears local and availability-focused, consistent with the CVSS vector.
Researcher notes
Evidence is specific to Linux mcba_usb coherent buffer cleanup. The sources identify root cause and stable commits, but do not provide distribution package mappings, exploit reports, or broader affected hardware beyond the Microchip CAN BUS Analyzer Tool.
Mitigation direction
- Update to a kernel or distro package containing the referenced stable fixes.
- Check Linux distribution advisories for exact fixed package versions.
- Prioritize systems using SocketCAN with Microchip CAN BUS Analyzer hardware.
- Limit local user and physical USB access on exposed systems.
- Remove or disable unused CAN USB driver support where operationally acceptable.
Validation and detection
- Inventory kernel versions against affected and fixed distro releases.
- Check whether mcba_usb is present, loaded, or packaged on relevant systems.
- Confirm Microchip CAN BUS Analyzer usage in labs, vehicles, or industrial environments.
- Review kernel update status for the referenced stable commits.
- Monitor for unexplained memory pressure on systems using the device.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 89df95ce32be204eef2e7d4b2f6fb552fb191a68
- Linux stable commit a115198caaab6d663bef75823a3c5f0802306d60
- Linux stable commit 6f87c0e21ad20dd3d22108e33db1c552dfa352a0
- Linux stable commit 6bd3d80d1f019cefa7011056c54b323f1d8b8e83
- Linux stable commit d0760a4ef85697bc756d06eae17ae27f3f055401
- Linux stable commit 91c02557174be7f72e46ed7311e3bea1939840b0
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47231 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/89df95ce32be204eef2e7d4b2f6fb552fb191a68CVE reference, Linux
- https://git.kernel.org/stable/c/a115198caaab6d663bef75823a3c5f0802306d60CVE reference, Linux
- https://git.kernel.org/stable/c/6f87c0e21ad20dd3d22108e33db1c552dfa352a0CVE reference, Linux
- https://git.kernel.org/stable/c/6bd3d80d1f019cefa7011056c54b323f1d8b8e83CVE reference, Linux
- https://git.kernel.org/stable/c/d0760a4ef85697bc756d06eae17ae27f3f055401CVE reference, Linux
- https://git.kernel.org/stable/c/91c02557174be7f72e46ed7311e3bea1939840b0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.