NULL pointer dereference in Linux kernel tty serial driver

1) NULL pointer dereference

EUVDB-ID: #VU90616

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47169

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the RP_ID(), rp2_remove_ports(), rp2_fw_cb(), rp2_probe() and rp2_remove() functions in drivers/tty/serial/rp2.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

External links

http://git.kernel.org/stable/c/1e04d5d5fe5e76af68f834e1941fcbfa439653be
http://git.kernel.org/stable/c/c697244ce940ec07e2d745ccb63ca97fc0266fbc
http://git.kernel.org/stable/c/1cc57cb32c84e059bd158494f746b665fc14d1b1
http://git.kernel.org/stable/c/35265552c7fe9553c75e324c80f45e28ff14eb6e
http://git.kernel.org/stable/c/915452f40e2f495e187276c4407a4f567ec2307e
http://git.kernel.org/stable/c/6a931ceb0b9401fe18d0c500e08164bf9cc7be4b
http://git.kernel.org/stable/c/9b07b6973f7359e2dd6a9fe6db0c142634c823b7
http://git.kernel.org/stable/c/016002848c82eeb5d460489ce392d91fe18c475c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.