Vulnerability identifier: #VU90060
Vulnerability risk: Low
CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-416
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the peak_pci_remove() function in drivers/net/can/sja1000/peak_pci.c. A local user can escalate privileges on the system.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: All versions
External links
http://git.kernel.org/stable/c/1c616528ba4aeb1125a06b407572ab7b56acae38
http://git.kernel.org/stable/c/447d44cd2f67a20b596ede3ca3cd67086dfd9ca9
http://git.kernel.org/stable/c/34914971bb3244db4ce2be44e9438a9b30c56250
http://git.kernel.org/stable/c/adbda14730aacce41c0d3596415aa39ad63eafd9
http://git.kernel.org/stable/c/1248582e47a9f7ce0ecd156c39fc61f8b6aa3699
http://git.kernel.org/stable/c/28f28e4bc3a5e0051faa963f10b778ab38c1db69
http://git.kernel.org/stable/c/0e5afdc2315b0737edcf55bede4ee1640d2d464d
http://git.kernel.org/stable/c/949fe9b35570361bc6ee2652f89a0561b26eec98
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.