#VU90013 Memory leak in Linux kernel - CVE-2021-47173

Vulnerability identifier: #VU90013

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47173

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the uss720_probe() function in drivers/usb/misc/uss720.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/5f46b2410db2c8f26b8bb91b40deebf4ec184391
https://git.kernel.org/stable/c/7889c70e6173ef358f3cd7578db127a489035a42
https://git.kernel.org/stable/c/bcb30cc8f8befcbdbcf7a016e4dfd4747c54a364
https://git.kernel.org/stable/c/386918878ce4cd676e4607233866e03c9399a46a
https://git.kernel.org/stable/c/36b5ff1db1a4ef4fdbc2bae364344279f033ad88
https://git.kernel.org/stable/c/5394ae9d8c7961dd93807fdf1b12a1dde96b0a55
https://git.kernel.org/stable/c/a3c3face38cb49932c62adcc1289914f1c742096
https://git.kernel.org/stable/c/dcb4b8ad6a448532d8b681b5d1a7036210b622de

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.