Out-of-bounds read in Linux kernel isdn capi driver

1) Out-of-bounds read

EUVDB-ID: #VU92900

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4439

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the detach_capi_ctr() function in drivers/isdn/capi/kcapi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

External links

http://git.kernel.org/stable/c/e8b8de17e164c9f1b7777f1c6f99d05539000036
http://git.kernel.org/stable/c/24219a977bfe3d658687e45615c70998acdbac5a
http://git.kernel.org/stable/c/9b6b2db77bc3121fe435f1d4b56e34de443bec75
http://git.kernel.org/stable/c/7d91adc0ccb060ce564103315189466eb822cc6a
http://git.kernel.org/stable/c/285e9210b1fab96a11c0be3ed5cea9dd48b6ac54
http://git.kernel.org/stable/c/7f221ccbee4ec662e2292d490a43ce6c314c4594
http://git.kernel.org/stable/c/cc20226e218a2375d50dd9ac14fb4121b43375ff
http://git.kernel.org/stable/c/1f3e2e97c003f80c4b087092b225c8787ff91e4d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.