Improper locking in Linux kernel hardware mISDN driver

1) Improper locking

EUVDB-ID: #VU92012

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47468

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nj_release() function in drivers/isdn/hardware/mISDN/netjet.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/6f95c97e0f9d6eb39c3f2cb45e8fa4268d1b372b
http://git.kernel.org/stable/c/ef269a8808cb1759245a98a7fe16fceaebad894c
http://git.kernel.org/stable/c/37e4f57b22cc5ebb3f80cf0f74fdeb487f082367
http://git.kernel.org/stable/c/a5b34409d3fc52114c828be4adbc30744fa3258b
http://git.kernel.org/stable/c/4054b869dc263228d30a4755800b78f0f2ba0c89
http://git.kernel.org/stable/c/9f591cbdbed3d7822b2bdba89b34a6d7b434317d
http://git.kernel.org/stable/c/f5966ba53013149bcf94e1536644a958dd00a026
http://git.kernel.org/stable/c/6510e80a0b81b5d814e3aea6297ba42f5e76f73c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.