CVE-2021-47364

What it actually does

The vulnerability is a memory leak in the compat_insnlist function handling 32-bit compatibility for the COMEDI_INSNLIST ioctl, where allocated memory for converted instruction arrays is not freed unless a fault occurs during population.

Why it matters to the business

Repeated triggering can lead to gradual memory exhaustion on affected systems, potentially causing instability or denial of service for users relying on COMEDI hardware interfaces.

How an attack unfolds

An attacker with access to the COMEDI device and ability to issue ioctls would repeatedly call the 32-bit compat version of the ioctl to trigger the leak without faults, accumulating unfreed memory over time.

How to fix it

Update the Linux kernel to a version containing the kfree addition in compat_insnlist() to ensure memory is released after successful ioctl processing.

How to confirm the fix worked

Review kernel source or applied patches for the added kfree call after array population; perform runtime testing with repeated 32-bit compat ioctls while monitoring slab allocations.

Typical attack path

1. Identify systems exposing COMEDI devices with CONFIG_COMPAT enabled
2. Obtain permissions to access the device node
3. Issue repeated COMEDI_INSNLIST ioctls through the 32-bit compatibility layer
4. Observe progressive kernel memory consumption without corresponding process growth

How to detect it

Inspect kernel logs and memory statistics for repeated allocations tied to comedi compat paths without matching frees; use tools such as kmemleak or slabtop during targeted ioctl testing.

What your security team should do

• Prioritize kernel updates on systems using the comedi subsystem
• Disable CONFIG_COMPAT where 32-bit ioctl support is unnecessary
• Restrict device access via permissions or SELinux policies if COMEDI functionality is not required
• Monitor kernel memory metrics for anomalous growth correlated with comedi usage