Information disclosure in Linux kernel i2c driver

1) Information disclosure

EUVDB-ID: #VU91338

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47425

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the i2c_acpi_notify() function in drivers/i2c/i2c-core-acpi.c. A local user can gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/b8090a84d7758b929d348bafbd86bb7a10c5fb63
http://git.kernel.org/stable/c/3d9d458a8aaafa47268ea4f1b4114a9f12927989
http://git.kernel.org/stable/c/60bacf259e8c2eb2324f3e13275200baaee9494b
http://git.kernel.org/stable/c/f86de018fd7a24ee07372d55ffa7824f0c674a95
http://git.kernel.org/stable/c/90f1077c9184ec2ae9989e4642f211263f301694
http://git.kernel.org/stable/c/6558b646ce1c2a872fe1c2c7cb116f05a2c1950f

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.