Denial of service in Linux kernel accel driver

1) Memory leak

EUVDB-ID: #VU89922

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47499

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the kxcjk1013_probe() and kxcjk1013_remove() functions in drivers/iio/accel/kxcjk-1013.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/8c1d43f3a3fc7184c42d7398bdf59a2a2903e4fc
https://git.kernel.org/stable/c/60a55b9d91ba99eb8cf015bc46dc2de05e168a15
https://git.kernel.org/stable/c/3899700ddacbf7aaafadf44464fff3ff0d4e3307
https://git.kernel.org/stable/c/a3730f74159ad00a28960c0efe2a931fe6fe6b45
https://git.kernel.org/stable/c/8c163a14277115ca962103910ab4cce55e862ffb
https://git.kernel.org/stable/c/ee86d0bad80bdcd11a87e188a596727f41b62320
https://git.kernel.org/stable/c/14508fe13b1c578b3d2ba574f1d48b351975860c
https://git.kernel.org/stable/c/70c9774e180d151abaab358108e3510a8e615215

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.