CVE-2021-47043

What it actually does

The vulnerability is a resource leak in the venus_probe() function of the Linux kernel's media venus driver, where interconnect (ICC) resources acquired via of_icc_get() are not released on error paths, requiring manual icc_put() cleanup that was missing.

Why it matters to the business

Affected Linux systems may experience gradual resource exhaustion in media subsystems if probe errors recur, leading to instability or degraded performance on devices using the venus driver, though low EPSS and lack of KEV status indicate limited real-world urgency after 965 days.

How an attack unfolds

An attacker with local access triggers error conditions after of_icc_get() succeeds during device probe to leak resources without cleanup; repeated triggering could exhaust interconnect handles, but the low EPSS trend and absence of known threat actors make active exploitation improbable.

How to fix it

Update the Linux kernel to a version incorporating the fix that replaces of_icc_get() with devm_of_icc_get(), updates the remove function, and removes unneeded icc_put() calls.

How to confirm the fix worked

Inspect kernel source for venus_probe() and venus_remove() to confirm devm_of_icc_get() usage and absence of manual icc_put(); verify via kernel version strings or build logs that the patch from 2024-02-28 is present.

Typical attack path

1. Gain local access to a system using the vulnerable venus driver
2. Induce repeated probe errors in the media venus core
3. Observe or accelerate resource depletion without proper release

How to detect it

Scan kernel logs for venus_probe error paths involving ICC allocation failures and monitor for signs of unreleased interconnect resources; no widespread exploitation indicators given KEV false status and stable low EPSS.

What your security team should do

• Prioritize kernel updates on systems exposing the venus driver despite low EPSS
• Review device tree and media subsystem error logs for probe failures
• Test patched kernels in non-production environments before broad deployment