CVE-2021-47133

What it actually does

Memory leak in the amd_sfh HID driver where request_list entries are not freed after processing, allowing repeated allocations without corresponding deallocations.

Why it matters to the business

Gradual memory exhaustion on affected Linux systems can lead to degraded performance, application failures, or system crashes over time, increasing operational costs and downtime risk especially on high-uptime servers or embedded devices.

How an attack unfolds

An attacker with local access or the ability to trigger sensor hub operations repeatedly causes the driver to allocate request_list entries during report requests without freeing them, exhausting kernel memory; the issue was resolved by adding explicit freeing of processed entries.

How to fix it

Update affected AlmaLinux 8 packages to the listed fixed versions such as sgabios 1:0.20170427git-3.module_el8.5.0+2608+72063365, libiscsi 1.18.0-8.module_el8.6.0+2880+7d9e3703, netcf 0.2.8-12.module_el8.5.0+2608+72063365, hivex 1.3.18-20.module_el8.3.0+2048+e7a0a3ea, libnbd 1.2.2-1.module_el8.5.0+2608+72063365, and libvirt 6.0.0-28.module_el8.3.0+2048+e7a0a3ea; apply kernel updates containing the amd_sfh fix and reboot.

How to confirm the fix worked

Verify installed package versions match the fixed releases, inspect kernel source for the added kfree on request_list removal, and run kmemleak scans post-update to confirm no leaks.

Typical attack path

1. Gain local execution context or trigger HID sensor operations
2. Repeatedly invoke amd_sfh_get_report or related sensor_hub calls
3. Accumulate unreleased request_list allocations in kernel memory
4. Monitor for kmemleak detections or system memory pressure
5. Induce denial of service via exhaustion

How to detect it

Review kmemleak reports for unreferenced amd_sfh allocations, monitor kernel memory usage trends, and inspect logs for repeated insmod or sensor_hub activity patterns.

What your security team should do

• Prioritize patching systems with high uptime or sensor usage within the next maintenance window
• Monitor EPSS and KEV status for any increase in exploit maturity
• Enable kmemleak or similar memory debugging in test environments to validate the fix