Resource management error in Linux kernel pci host driver

1) Resource management error

EUVDB-ID: #VU93455

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47229

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the advk_pcie_wait_pio(), advk_pcie_rd_conf() and advk_pcie_wr_conf() functions in drivers/pci/host/pci-aardvark.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/400e6b1860c8be61388d0b77814c53260f96e17a
http://git.kernel.org/stable/c/b00a9aaa4be20ad6e3311fb78a485eae0899e89a
http://git.kernel.org/stable/c/4c90f90a91d75c3c73dd633827c90e8746d9f54d
http://git.kernel.org/stable/c/1a1dbc4473974867fe8c5f195c17b341c8e82867
http://git.kernel.org/stable/c/3d213a4ddf49a860be6e795482c17f87e0c82b2a
http://git.kernel.org/stable/c/f18139966d072dab8e4398c95ce955a9742e04f7

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.