Vulnerability identifier: #VU104452
Vulnerability risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-416
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the efx_ef10_try_update_nic_stats_vf() function in drivers/net/ethernet/sfc/ef10.c. A local user can escalate privileges on the system.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: All versions
External links
https://git.kernel.org/stable/c/16662524ec5da801fb78a1afcaf6e782f1cf103a
https://git.kernel.org/stable/c/68e5f32f0de9594629ff9e599294d9801c6187de
https://git.kernel.org/stable/c/82bcb730f856086f033e6c04082eb4503d4c2fa4
https://git.kernel.org/stable/c/ada74c5539eba06cf8b47d068f92e0b3963a9a6e
https://git.kernel.org/stable/c/b82e4ad58a7fb72456503958a93060f87896e629
https://git.kernel.org/stable/c/b9072305270579a9d6afc9b926166231e5b1a7c8
https://git.kernel.org/stable/c/d9840212a9c00507347c703f4fdeda16400407e0
https://git.kernel.org/stable/c/da346adcf5573fd8663cabfdfe8371009629a906
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.