CVE-2021-47345 – A memory leak vulnerability exists in the Linux... (How to Fix)

Q: What is the severity of CVE-2021-47345?

CVE-2021-47345 has a CVSS score of 5.5 (MEDIUM). A memory leak vulnerability exists in the Linux kernel's RDMA/CMA subsystem when rdma_resolve_route() is called multiple times on the same rdma_cm_id. This can cause gradual memory exhaustion on systems using RDMA (Remote Direct Memory Access), potentially affecting servers and high-performance computing clusters that utilize RDMA for low-latency networking.

📋 TL;DR

A memory leak vulnerability exists in the Linux kernel's RDMA/CMA subsystem when rdma_resolve_route() is called multiple times on the same rdma_cm_id. This can cause gradual memory exhaustion on systems using RDMA (Remote Direct Memory Access), potentially affecting servers and high-performance computing clusters that utilize RDMA for low-latency networking.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not specified in CVE; check git commits for exact ranges

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems with RDMA/CMA subsystem enabled and in use. Most standard Linux installations do not have RDMA enabled by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could lead to kernel memory exhaustion, causing system instability, denial of service, or kernel panic/crash.

🟠

Likely Case

Gradual memory consumption over time leading to performance degradation and potential service disruption in RDMA-dependent applications.

🟢

If Mitigated

Minimal impact with proper monitoring and memory limits in place; may cause occasional performance issues.

🌐 Internet-Facing: LOW - RDMA is typically used in internal high-performance networks, not directly internet-facing.

🏢 Internal Only: MEDIUM - Affects internal systems using RDMA for high-performance computing, storage, or database clusters.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to trigger RDMA connection state machine errors repeatedly. Requires local access or ability to interact with RDMA services.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check kernel git commits for specific fixed versions

Vendor Advisory: https://git.kernel.org/stable/c/032c68b4f5be128a2167f35b558b7cec88fe4972

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific security advisories. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable RDMA/CMA if not needed

linux

Disable RDMA CMA subsystem if not required for system functionality

modprobe -r rdma_cm
echo 'blacklist rdma_cm' >> /etc/modprobe.d/blacklist.conf

Monitor memory usage

linux

Implement monitoring for abnormal memory consumption in RDMA processes

watch -n 60 'cat /proc/meminfo | grep -E "MemFree|MemAvailable"'

🧯 If You Can't Patch

Implement strict memory limits for RDMA-related processes using cgroups
Monitor system logs for RDMA connection errors and restart affected services

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if RDMA CMA module is loaded: lsmod | grep rdma_cm

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and check for memory leaks in RDMA processes over time

📡 Detection & Monitoring

Log Indicators:

Kernel oom-killer messages
RDMA connection error logs
Abnormal memory consumption in /var/log/messages

Network Indicators:

Unusual RDMA connection retry patterns

SIEM Query:

source="kernel" AND ("oom" OR "out of memory") AND process="rdma"

📊 Metadata

CVE ID: CVE-2021-47345

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

Published: May 21, 2024

Last Updated: December 24, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47345, you might also want to check these: