CVE-2021-47042

What it actually does

The vulnerability is a memory leak in the dc_link_construct() function within the AMD display driver (amdgpu), where allocated memory for link data is not freed after use during driver initialization.

Why it matters to the business

Repeated loading of the AMD GPU driver can lead to memory exhaustion, potentially causing system instability or requiring reboots on affected Linux systems with AMD graphics hardware.

How an attack unfolds

An attacker with the ability to trigger repeated module loads or device probes on a system with an AMD GPU can cause the memory leak to accumulate, leading to resource exhaustion. No remote exploitation path is indicated.

How to fix it

Apply the kernel patch that frees the local data after use in dc_link_construct(). Monitor for upstream Linux kernel updates containing this fix.

How to confirm the fix worked

Verify the presence of the fix by checking the kernel source for the memory free operation following allocation in link_create or dc_link_construct. Test by loading the module and checking for leaks with kmemleak or similar tools.

Typical attack path

1. Trigger AMD GPU driver initialization or probe
2. Cause repeated allocation without deallocation in dc_link_construct
3. Accumulate unreferenced memory objects until exhaustion

How to detect it

Look for unreferenced memory objects allocated during amdgpu module load in kernel memory leak detectors. Check system logs for amd_module_load processes and monitor for increasing memory usage without corresponding frees.

What your security team should do

• Prioritize patching Linux kernels with AMD GPU support
• Monitor memory usage on systems with AMD GPUs
• Apply updates from distribution vendors