CVE-2021-47624

What it actually does

Reference count leak of rpc_xprt and rpc_xprt_switch objects in rpc_sysfs_xprt_state_change error path when input buffer matches none of the expected state strings, leaving objects with elevated counts.

Why it matters to the business

Gradual resource exhaustion in kernel networking subsystems on affected Linux distributions can degrade system stability and availability, with urgency increased by the large number of downstream package dependents across Debian and Ubuntu releases.

How an attack unfolds

An attacker with local access writes an unexpected value to the relevant sysfs xprt state attribute, triggering the early return that omits the paired decrements performed by the getter helpers, causing cumulative leaks; no named threat actors are associated with this issue.

How to fix it

Upgrade affected packages to the listed fixed versions: linux (Debian:12) to 5.15.15-1, linux (Debian:13) to 5.15.15-1, linux (Ubuntu:20.04:LTS) to 5.4.0-9.12, linux-aws (Ubuntu:20.04:LTS) to 5.4.0-1005.5, linux-aws-5.15 (Ubuntu:20.04:LTS) to 5.15.0-1014.18~20.04.1, linux-azure (Ubuntu:20.04:LTS) to 5.4.0-1006.6, linux-azure-5.15 (Ubuntu:20.04:LTS) to 5.15.0-1007.8~20.04.1, linux-azure-fde-5.15 (Ubuntu:20.04:LTS) to 5.15.0-1019.24~20.04.1.1, linux-bluefield (Ubuntu:20.04:LTS) to 5.4.0-1007.10, linux-gcp (Ubuntu:20.04:LTS) to 5.4.0-1005.5, linux-gcp-5.15 (Ubuntu:20.04:LTS) to 5.15.0-1006.9~20.04.1, linux-gkeop (Ubuntu:20.04:LTS) to 5.4.0-1008.9, linux-gkeop-5.15 (Ubuntu:20.04:LTS) to 5.15.0-1003.5~20.04.2; apply vendor kernel updates immediately given 825 days since publication.

How to confirm the fix worked

Verify installed kernel and package versions match or exceed the fixed releases above; confirm the corrected error-handling path is present by inspecting the rpc_sysfs_xprt_state_change source or running targeted sysfs write tests that exercise the out_put label.

Typical attack path

1. Obtain local shell or equivalent access on target system
2. Locate the rpc_sysfs xprt state_change attribute under /sys
3. Write a non-matching string such as an arbitrary value to the attribute
4. Repeat to accelerate object reference accumulation
5. Observe eventual impact on memory or networking resources

How to detect it

Review kernel logs and audit trails for repeated writes to rpc_sysfs xprt state_change attributes that return EINVAL; correlate with gradual increases in rpc_xprt object counts via slabinfo or memory accounting; no specific threat actor indicators apply.

What your security team should do

• Apply the exact fixed package versions for each distribution immediately
• Prioritize systems exposing sysfs interfaces to untrusted local users
• Monitor EPSS trend (stable at 0.0024) and reassess if new exploit maturity appears
• Harden sysfs permissions where rpc xprt attributes are accessible