Vulnerability identifier: #VU90011

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47171

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the smsc75xx_bind() function in drivers/net/usb/smsc75xx.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/200dbfcad8011e50c3cec269ed7b980836eeb1fa
http://git.kernel.org/stable/c/22c840596af0c09068b6cf948616e6496e59e07f
http://git.kernel.org/stable/c/9e6b8c1ff9d997e1fa16cbd2d60739adf6dc1bbc
http://git.kernel.org/stable/c/9e6a3eccb28779710cbbafc4f4258d92509c6d07
http://git.kernel.org/stable/c/b95fb96e6339e34694dd578fb6bde3575b01af17
http://git.kernel.org/stable/c/635ac38b36255d3cfb8312cf7c471334f4d537e0
http://git.kernel.org/stable/c/70c886ac93f87ae7214a0c69151a28a8075dd95b
http://git.kernel.org/stable/c/46a8b29c6306d8bbfd92b614ef65a47c900d8e70

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.