#VU104406 Memory leak in Linux kernel - CVE-2021-47648

Vulnerability identifier: #VU104406

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47648

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the host1x_remove() function in drivers/gpu/host1x/dev.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/025c6643a81564f066d8381b9e2f4603e0f8438f
https://git.kernel.org/stable/c/5124a344983e1b9670dae7add0e4d00d589aabcd
https://git.kernel.org/stable/c/6bb107332db28a0e9256c2d36a0902b85307612c
https://git.kernel.org/stable/c/c06577a80485511b894cb688e881ef0bc2d1d296
https://git.kernel.org/stable/c/fe1ce680560d4f0049ffa0c687de17567421c1ec

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.