#VU90050 Use-after-free in Linux kernel - CVE-2021-47500

Vulnerability identifier: #VU90050

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47500

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mma8452_trigger_setup() function in drivers/iio/accel/mma8452.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/094d513b78b1714113bc016684b8142382e071ba
https://git.kernel.org/stable/c/fb75cc4740d81264cd5bcb0e17d961d018a8be96
https://git.kernel.org/stable/c/794c0898f6bf39a458655d5fb4af70ec43a5cfcb
https://git.kernel.org/stable/c/f5deab10ced368c807866283f8b79144c4823be8
https://git.kernel.org/stable/c/acf0088ac073ca6e7f4cad6acac112177e08df5e
https://git.kernel.org/stable/c/db12d95085367de8b0223929d1332731024441f1
https://git.kernel.org/stable/c/c43517071dfc9fce34f8f69dbb98a86017f6b739
https://git.kernel.org/stable/c/cd0082235783f814241a1c9483fb89e405f4f892

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.