Vulnerability identifier: #VU88893

Vulnerability risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46966

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cm_write() function in drivers/acpi/custom_method.c. A local user can trigger a use-after-free error and escalate privileges on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/1d53ca5d131074c925ce38361fb0376d3bf7e394
http://git.kernel.org/stable/c/8b04d57f30caf76649d0567551589af9a66ca9be
http://git.kernel.org/stable/c/90575d1d9311b753cf1718f4ce9061ddda7dfd23
http://git.kernel.org/stable/c/a5b26a2e362f572d87e9fd35435680e557052a17
http://git.kernel.org/stable/c/72814a94c38a33239793f7622cec6ace1e540c4b
http://git.kernel.org/stable/c/62dc2440ebb552aa0d7f635e1697e077d9d21203
http://git.kernel.org/stable/c/f16737caf41fc06cfe6e49048becb09657074d4b
http://git.kernel.org/stable/c/b7a5baaae212a686ceb812c32fceed79c03c0234
http://git.kernel.org/stable/c/e483bb9a991bdae29a0caa4b3a6d002c968f94aa

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.