CVE-2021-47009

What it actually does

Failure to free allocated 'td' object on two error return paths in security/keys/trusted-keys/trusted_tpm1.c leads to a kernel memory leak.

Why it matters to the business

Repeated triggering of the affected error paths can gradually exhaust kernel memory, degrading system stability and performance until a reboot or OOM kill occurs; low EPSS and absence from KEV indicate limited real-world urgency.

How an attack unfolds

An attacker with local access crafts inputs that exercise the two error paths in the trusted TPM1 key code, causing the kernel to allocate but never release 'td' objects; over many iterations this exhausts memory without requiring code execution or privilege escalation.

How to fix it

Update to a Linux kernel that includes the fix for the memory leak in trusted_tpm1.c (the patch ensures td is always freed via the secure kfree path); rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel source contains the corrected return paths that call kfree on td; re-run clang scan-build or equivalent static analysis to confirm the unix.Malloc warning is resolved; monitor kernel memory usage under load that exercises the previously leaky paths.

Typical attack path

1. Obtain local unprivileged access to a Linux system using the vulnerable kernel
2. Invoke trusted key operations that hit the error paths in trusted_tpm1.c
3. Repeat the triggering sequence to accumulate unfreed allocations
4. Monitor for memory pressure or system instability

How to detect it

Examine kernel logs and memory accounting for repeated allocations without corresponding frees in the trusted-keys module; correlate with processes performing keyctl or TPM operations around the time of increased slab or kmalloc activity.

What your security team should do

• Apply the upstream kernel patch or distribution update containing the td kfree fix at the earliest scheduled maintenance window
• Include the affected trusted-keys code path in future kernel static-analysis and fuzzing runs
• Monitor EPSS and KEV updates for any change in exploit maturity