Memory leak in Linux kernel ipack devices driver

1) Memory leak

EUVDB-ID: #VU91624

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47401

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ipoctal_inst_slot() and __ipoctal_remove() functions in drivers/ipack/devices/ipoctal.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:

External links

http://git.kernel.org/stable/c/acb96e782bad427ca4bb1bd94af660acd1462380
http://git.kernel.org/stable/c/741ea2670e021350e54f491106bdaa22dc50e6a0
http://git.kernel.org/stable/c/2725925982dc96a78069cd118ea3d66759bfdad7
http://git.kernel.org/stable/c/829f13d6079cf7a2465522f39acb43033e9b320d
http://git.kernel.org/stable/c/8657158a3b68c85234e6da3d8eae33d6183588b7
http://git.kernel.org/stable/c/5f6a309a699675680df15d9b6d389114515b4426
http://git.kernel.org/stable/c/0a9c36a2e06a249acbed64e8e0b84637c2ad7575
http://git.kernel.org/stable/c/a89936cce87d60766a75732a9e7e25c51164f47c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.