CVE-2021-47313

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: CPPC: Fix potential memleak in cppc_cpufreq_cpu_init

Its a classic example of memleak, we allocate something, we fail and never free the resources.

Make sure we free all resources on policy ->init() failures.

Weakness

The product does not properly control the allocation and maintenance of a limited resource.

Affected Software

Potential Mitigations

• Mitigation of resource exhaustion attacks requires that the target system either:

• The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.

• The second solution is simply difficult to effectively institute – and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/147.html
• https://cwe.mitre.org/data/definitions/227.html
• https://cwe.mitre.org/data/definitions/492.html

References

• https://git.kernel.org/stable/c/b775383355755885b19d2acef977f1ca132e80a3
• https://git.kernel.org/stable/c/e1b2b2b61d30d7ce057ec17237c217d152ed97f2
• https://git.kernel.org/stable/c/fe2535a44904a77615a3af8e8fd7dafb98fb0e1b
• https://git.kernel.org/stable/c/b775383355755885b19d2acef977f1ca132e80a3
• https://git.kernel.org/stable/c/e1b2b2b61d30d7ce057ec17237c217d152ed97f2
• https://git.kernel.org/stable/c/fe2535a44904a77615a3af8e8fd7dafb98fb0e1b