CVE-2021-47059

What it actually does

Memory leak on an error path in the sun8i-ss kernel crypto driver causes allocated result buffers to never be freed when certain failure conditions occur during hardware-accelerated crypto operations.

Why it matters to the business

Systems relying on this Allwinner-based crypto accelerator may experience gradual kernel memory exhaustion under repeated error conditions, leading to degraded performance, increased swapping, or eventual system instability that requires reboots.

How an attack unfolds

An attacker with the ability to trigger repeated error paths in the sun8i-ss driver (for example by submitting malformed crypto requests or operating under resource-constrained conditions) causes the kernel to allocate memory that is never released, slowly depleting available memory.

How to fix it

Apply the upstream kernel patch that adds the missing free on the error path; update to a kernel release containing the fix for CVE-2021-47059 and reboot affected systems.

How to confirm the fix worked

Confirm the presence of the corrected error-handling code in the sun8i-ss source or verify the running kernel is newer than the vulnerable commit; monitor kernel memory statistics before and after crypto error injection tests.

Typical attack path

1. Identify a system using the sun8i-ss crypto driver
2. Craft inputs that force the driver into documented error paths
3. Repeat the triggering sequence to accumulate leaked allocations
4. Observe system-wide memory pressure or OOM conditions

How to detect it

Review kernel logs for sun8i-ss error messages paired with rising slab or kmalloc usage; correlate with processes invoking crypto APIs; look for gradual increases in kernel memory that do not correspond to workload growth.

What your security team should do

• Prioritize patching kernel packages on all systems that expose the sun8i-ss driver
• Audit workloads that perform frequent crypto operations for unexpected memory growth
• Add kernel memory usage and OOM killer alerts to existing monitoring