CVE-2021-47313

What it actually does

The vulnerability is a memory leak in cppc_cpufreq_cpu_init where resources allocated during policy initialization are not freed if the operation fails afterward.

Why it matters to the business

Long-running systems may suffer gradual memory exhaustion leading to performance degradation, instability, or crashes, increasing operational overhead especially on servers with CPPC cpufreq enabled.

How an attack unfolds

An attacker with local access triggers repeated failures during cpufreq policy initialization to cause unchecked allocations and deplete system memory resources.

How to fix it

Update affected systems to a kernel version containing the fix that frees all resources on policy init failures; for glpi-project/glpi (GIT) apply the change from commit 0c860f018f5bd0f08b87d217a376304e62a5ba58.

How to confirm the fix worked

Inspect the cppc_cpufreq_cpu_init function to confirm error paths now release allocated resources, and test policy initialization failure scenarios for proper cleanup.

Typical attack path

1. Obtain local access on a target system
2. Induce conditions that cause cppc_cpufreq_cpu_init to fail after allocation
3. Repeat the process to accumulate unfreed memory

How to detect it

Examine kernel logs for cpufreq initialization errors, track memory consumption patterns associated with policy init, and review any related allocation failure traces.

What your security team should do

• Prioritize patching systems running the affected cpufreq code due to the local high-impact memory corruption
• Review kernel configurations using CPPC for exposure
• Monitor memory usage trends post-update