CVE-2021-47231

What it actually does

Unfreed USB coherent buffers allocated in mcba_usb_start() cause persistent kernel memory leaks because disconnect paths kill URBs without setting URB_FREE_BUFFER and the resubmit callback never releases them.

Why it matters to the business

Systems using the Microchip CAN BUS Analyzer Tool driver can gradually exhaust kernel memory, leading to performance degradation or crashes during extended operation or repeated device connect/disconnect cycles.

How an attack unfolds

An attacker with local or USB access repeatedly attaches and detaches a compatible device (or emulates the mcba_usb interface) to trigger allocation of 20 coherent buffers per start without corresponding usb_free_coherent calls, exhausting memory over time.

How to fix it

Apply the upstream fix that adds explicit usb_free_coherent() calls in the disconnect path for all allocated buffers; update to a kernel containing the resolution of this memory leak.

How to confirm the fix worked

Verify the patch is present by inspecting mcba_usb.c for usb_free_coherent() calls after URB kill in disconnect; run kmemleak scans after device disconnect to confirm no new suspected leaks from mcba_usb.

Typical attack path

1. Attach or emulate mcba_usb device to trigger mcba_usb_start()
2. Allow driver to allocate 20 usb coherent buffers
3. Disconnect device or kill URBs without freeing buffers
4. Repeat attachment/disconnection cycle to accumulate leaks
5. Monitor kmemleak reports or observe system memory pressure

How to detect it

Search kernel logs and kmemleak output for messages referencing mcba_usb, can0 device disconnect, and reports of 20 new suspected memory leaks; correlate with USB attach/detach events.

• mcba_usb
• kmemleak: 20 new suspected memory leaks
• can0: device disconnected
• usb_coherent

What your security team should do

• Prioritize kernel update on any system exposing the mcba_usb driver
• Disable the driver module if the hardware is not required
• Enable kmemleak or similar kernel memory debugging in test environments
• Monitor for device disconnect events involving mcba_usb