#VU90011 Memory leak in Linux kernel - CVE-2021-47171

Vulnerability identifier: #VU90011

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47171

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the smsc75xx_bind() function in drivers/net/usb/smsc75xx.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/200dbfcad8011e50c3cec269ed7b980836eeb1fa
https://git.kernel.org/stable/c/22c840596af0c09068b6cf948616e6496e59e07f
https://git.kernel.org/stable/c/9e6b8c1ff9d997e1fa16cbd2d60739adf6dc1bbc
https://git.kernel.org/stable/c/9e6a3eccb28779710cbbafc4f4258d92509c6d07
https://git.kernel.org/stable/c/b95fb96e6339e34694dd578fb6bde3575b01af17
https://git.kernel.org/stable/c/635ac38b36255d3cfb8312cf7c471334f4d537e0
https://git.kernel.org/stable/c/70c886ac93f87ae7214a0c69151a28a8075dd95b
https://git.kernel.org/stable/c/46a8b29c6306d8bbfd92b614ef65a47c900d8e70

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.