Memory leak in Linux kernel usb

1) Memory leak

EUVDB-ID: #VU89949

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47239

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the smsc75xx_bind() and smsc75xx_unbind() functions in drivers/net/usb/smsc75xx.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/7cc8b2e05fcea6edd022d26e82091d781af8fd9b
https://git.kernel.org/stable/c/64160d1741a3de5204d1a822e058e0b4cc526504
https://git.kernel.org/stable/c/c4e3be2e7742863e454ce31faf8fd0109c00050b
https://git.kernel.org/stable/c/2fc8300c9cfa5167fcb5b1a2a07db6f53e82f59b
https://git.kernel.org/stable/c/4252bf6c2b245f47011098113d405ffad6ad5d5b
https://git.kernel.org/stable/c/570a52cf3e01d19f7fd1a251dfc52b0cd86c13cb
https://git.kernel.org/stable/c/14616c372a7be01a2fb8c56c9d8debd232b9e43d
https://git.kernel.org/stable/c/56b786d86694e079d8aad9b314e015cd4ac02a3d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.