#VU89971 Memory leak in Linux kernel - CVE-2021-47423

Vulnerability identifier: #VU89971

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47423

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the drivers/gpu/drm/nouveau/nouveau_debugfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/df0c9418923679bc6d0060bdb1b5bf2c755159e0
https://git.kernel.org/stable/c/9f9d4c88b2edc7924e19c44909cfc3fa4e4d3d43
https://git.kernel.org/stable/c/1508b09945bde393326a9dab73b1fc35f672d771
https://git.kernel.org/stable/c/11cd944bb87d9e575b94c07c952105eda745b459
https://git.kernel.org/stable/c/f69556a42043b5444ca712ee889829ba89fdcba8
https://git.kernel.org/stable/c/88c3610045ca6e699331b6bb5c095c5565f30721
https://git.kernel.org/stable/c/f5a8703a9c418c6fc54eb772712dfe7641e3991c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.