CVE-2021-47249

What it actually does

Missing decrement of an RDS incoming message reference count in the error path of rds_recvmsg when rds_cmsg_recv fails, causing a memory leak on each occurrence.

Why it matters to the business

Over time, repeated triggering can exhaust kernel memory on systems using RDS sockets, leading to degraded performance, instability, or crashes in networked applications or clusters.

How an attack unfolds

An attacker with local access or the ability to interact with an RDS socket triggers the error path in rds_recvmsg (for example by supplying malformed ancillary data that causes rds_cmsg_recv to return EFAULT) repeatedly, leaking kernel memory with each failed receive operation.

How to fix it

Apply the upstream kernel patch that adds the missing rds_inc_put call in the rds_cmsg_recv error path; update to a kernel version containing the fix for CVE-2021-47249.

How to confirm the fix worked

Confirm the running kernel contains the commit that pairs rds_inc_addref with rds_inc_put in the rds_recvmsg error path; review dmesg or slabinfo for unexpected RDS inc allocations under load; re-test the error path with a reproducer that forces rds_cmsg_recv failure.

Typical attack path

1. Obtain ability to send or receive on an RDS socket (local user, container, or remote peer depending on RDS usage)
2. Craft input that causes rds_cmsg_recv to fail after rds_inc_addref has already been called
3. Repeat the operation to accumulate unreleased references and exhaust memory

How to detect it

Inspect kernel logs and slabinfo for repeated RDS inc allocations without corresponding frees; correlate with application logs showing frequent rds_recvmsg errors; review ftrace or perf data for unbalanced rds_inc_addref calls in the receive path.

What your security team should do

• Prioritize kernel updates on systems that expose RDS sockets or run RDS-dependent workloads
• Monitor memory usage and slab statistics on RDS-enabled hosts for unexplained growth
• Restrict untrusted local access or container workloads that can open RDS sockets until patched