CVE-2021-47345

What it actually does

Memory leak occurs when rdma_resolve_route() is invoked multiple times on the same rdma_cm_id after cma_query_handler() triggers an RDMA_CM_EVENT_ROUTE_ERROR that resets state without freeing prior allocations.

Why it matters to the business

Repeated triggering of the affected RDMA path can gradually exhaust kernel memory, leading to degraded performance or denial of service on systems using RDMA/CMA; the reported downstream prevalence is low and no active exploitation campaigns are known.

How an attack unfolds

An attacker with the ability to initiate RDMA connection attempts against a vulnerable system forces the RDMA_CM_EVENT_ROUTE_ERROR path repeatedly, causing the kernel to leak memory on each re-invocation of rdma_resolve_route() until resources are exhausted.

How to fix it

Upgrade affected kernels or dependent packages to a version containing commit 6c57ba0f073d6be5a4f508c46c2ce36727cbce80; apply vendor patches that prevent re-entry into rdma_resolve_route() without proper cleanup.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or package; monitor for absence of repeated memory growth under synthetic RDMA route-error workloads after patching.

Typical attack path

1. Establish an RDMA-capable network path to the target
2. Issue repeated rdma_resolve_route() calls that induce RDMA_CM_EVENT_ROUTE_ERROR
3. Observe gradual kernel memory growth without corresponding release
4. Continue until memory pressure causes service degradation or crash

How to detect it

Search kernel logs and memory accounting tools for repeated RDMA_CM_EVENT_ROUTE_ERROR entries paired with steadily increasing slab or kmalloc usage attributable to rdma_cm_id structures; no public exploit artifacts are known.

What your security team should do

• Prioritize patching systems that expose RDMA/CMA interfaces to untrusted networks
• Apply the referenced commit or later kernel update within standard change windows given low EPSS and no KEV listing
• Review RDMA usage in internal applications and disable where not required