CVE-2021-47516

What it actually does

Memory leak in nfp_cpp_area_cache_add where nfp_cpp_area_alloc succeeds but a subsequent kzalloc failure returns without freeing the allocated CPP area structure, leaving kernel memory allocated indefinitely.

Why it matters to the business

Over time, repeated triggering can exhaust kernel memory on affected systems, leading to degraded performance, service disruptions, or system instability in environments using NFP-based network devices.

How an attack unfolds

An attacker with local access repeatedly invokes the nfp_cpp_area_cache_add function under conditions that cause the kzalloc to fail after the area allocation, gradually leaking memory until the system becomes unresponsive.

How to fix it

Apply the upstream fix that adds the missing kfree on kzalloc failure in nfp_cpp_area_cache_add, or upgrade to a Linux kernel version that includes the resolution for this leak.

How to confirm the fix worked

Review the nfp_cpp_area_cache_add implementation to confirm a kfree(area) path exists on kzalloc failure; monitor kernel memory usage under load for absence of unexplained growth attributable to this function.

Typical attack path

1. Obtain local user access on a Linux system with the vulnerable NFP driver loaded.
2. Trigger repeated calls to nfp_cpp_area_cache_add with parameters that pass the first allocation but fail the cache kzalloc.
3. Observe gradual kernel memory consumption without corresponding frees.
4. Continue until memory pressure causes denial of service.

How to detect it

Monitor kernel logs and memory statistics for repeated allocation patterns in NFP driver code; look for increasing slab or vmalloc usage without corresponding process activity that would explain it.

What your security team should do

• Prioritize patching or upgrading affected Linux kernels on systems with NFP hardware.
• Restrict local user access where possible to reduce attack surface for memory exhaustion.
• Implement kernel memory monitoring and alerting for early detection of leaks.
• Test patched kernels in staging environments before production rollout.