CVE-2024-41002

What it actually does

Failure to release AIV resources during SEC driver resource cleanup in the Linux kernel HiSilicon SEC crypto driver results in a memory leak on every resource release cycle.

Why it matters to the business

Systems using affected HiSilicon hardware accelerators may experience gradual memory exhaustion over time, leading to performance degradation, increased operational costs, or eventual service disruption in long-running environments; the low EPSS and lack of KEV status indicate limited immediate urgency but kernel updates remain necessary due to widespread Linux deployment.

How an attack unfolds

An attacker with local access or the ability to trigger repeated allocation and release of SEC resources can cause unbounded memory growth; listed threat actors in 2024 zero-day campaigns and Linux kernel resource issues could leverage similar patterns in targeted environments, though no public exploitation is recorded for this specific leak.

How to fix it

Update the Linux kernel to include commit a886bcb0f67d1e3d6b2da25b3519de59098200c2 or later stable releases that add AIV resource release to the SEC cleanup path; apply distribution-specific backports where available and verify the fix is present in the sec resource release function.

How to confirm the fix worked

Inspect the sec resource release function source for the added AIV release call; confirm kernel builds contain the referenced commit hash; test by exercising SEC resource cycles and verifying no incremental memory growth via system monitoring tools.

Typical attack path

1. Identify systems running vulnerable Linux kernel versions with HiSilicon SEC hardware enabled
2. Trigger repeated SEC resource allocation and release operations via user-space crypto workloads or driver interfaces
3. Monitor for cumulative memory consumption increase without corresponding process activity
4. Sustain the pattern to exhaust available memory and induce system instability

How to detect it

Review kernel memory statistics and process accounting logs for unexplained growth correlated with SEC driver activity; examine dmesg or kernel logs for repeated resource allocation patterns without matching release events.

What your security team should do

• Prioritize kernel updates on all systems exposing HiSilicon SEC hardware
• Review and apply the exact fixed commit across stable branches
• Monitor memory metrics on affected hosts during normal crypto workloads
• Incorporate kernel version checks into vulnerability scanning processes