Memory leak in Linux kernel drm nouveau driver

1) Memory leak

EUVDB-ID: #VU89971

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47423

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the drivers/gpu/drm/nouveau/nouveau_debugfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/df0c9418923679bc6d0060bdb1b5bf2c755159e0
http://git.kernel.org/stable/c/9f9d4c88b2edc7924e19c44909cfc3fa4e4d3d43
http://git.kernel.org/stable/c/1508b09945bde393326a9dab73b1fc35f672d771
http://git.kernel.org/stable/c/11cd944bb87d9e575b94c07c952105eda745b459
http://git.kernel.org/stable/c/f69556a42043b5444ca712ee889829ba89fdcba8
http://git.kernel.org/stable/c/88c3610045ca6e699331b6bb5c095c5565f30721
http://git.kernel.org/stable/c/f5a8703a9c418c6fc54eb772712dfe7641e3991c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.