CVE-2021-45480

What it actually does

Memory leak in __rds_conn_create() within the RDS subsystem allows repeated allocation without corresponding release under specific connection creation conditions, gradually exhausting kernel memory and impacting availability.

Why it matters to the business

Systems using the RDS protocol may experience progressive resource depletion leading to degraded performance, service disruption, or kernel-level denial of service; widespread Linux kernel usage increases exposure across servers and containers.

How an attack unfolds

An attacker with local access repeatedly triggers RDS connection creation paths that invoke the leaky code path, causing incremental memory consumption until the system becomes unstable or crashes.

How to fix it

Upgrade the Linux kernel to version 5.15.11 or later; apply commit 5f9562ebe710c307adc5f666bf1a2162ee7977c0 to the torvalds/linux repository; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version is 5.15.11 or newer; confirm the presence of commit 5f9562ebe710c307adc5f666bf1a2162ee7977c0 in the kernel source tree; test RDS connection workloads for stable memory usage.

Typical attack path

1. Obtain local user or container access on an affected Linux system
2. Load or exercise the RDS kernel module and issue repeated connection establishment calls
3. Trigger the specific combination of circumstances that invokes __rds_conn_create() without cleanup
4. Monitor memory consumption until exhaustion produces denial of service

How to detect it

Review kernel logs for repeated RDS connection creation messages accompanied by rising memory usage; inspect /proc/meminfo and slab allocator statistics for anomalous growth in connection-related objects; correlate with local process activity creating RDS sockets.

What your security team should do

• Prioritize kernel upgrades on systems exposing RDS or running untrusted workloads
• Monitor memory usage trends on production Linux hosts using RDS
• Restrict unprivileged local access where feasible until patches are applied
• Include kernel version checks in vulnerability scanning and asset inventories