#VU104741 Double free in Linux kernel - CVE-2021-47638

Vulnerability identifier: #VU104741

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47638

CWE-ID: CWE-415

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the do_rename() function in fs/ubifs/dir.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/14276d38c89a170363e90b6ac0a53c3cf61b87fc
https://git.kernel.org/stable/c/2ad07009c459e56ebdcc089d850d664660fdb742
https://git.kernel.org/stable/c/2b3236ecf96db7af5836e1366ce39ace8ce832fa
https://git.kernel.org/stable/c/40a8f0d5e7b3999f096570edab71c345da812e3e
https://git.kernel.org/stable/c/6d7a158a7363c1f6604aa47ae1a280a5c65123dd
https://git.kernel.org/stable/c/8b3c7be16f3f4dfd6e15ac651484e59d3fa36274
https://git.kernel.org/stable/c/a90e2dbe66d2647ff95a0442ad2e86482d977fd8
https://git.kernel.org/stable/c/b9a937f096e608b3368c1abc920d4d640ba2c94f

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.