Vulnerability identifier: #VU90103

Vulnerability risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47311

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the emac_remove() function in drivers/net/ethernet/qualcomm/emac/emac.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/4d04a42b926e682140776e54188f4a44f1f01a81
http://git.kernel.org/stable/c/b1e091331920f8fbfc747dcbd16263fcd71abb2d
http://git.kernel.org/stable/c/11e9d163d631198bb3eb41a677a61b499516c0f7
http://git.kernel.org/stable/c/2b70ca92847c619d6264c7372ef74fcbfd1e048c
http://git.kernel.org/stable/c/b560521eca03d0a2db6093a5a632cbdd0a0cf833
http://git.kernel.org/stable/c/8a225a6e07a57a1538d53637cb3d82bd3e477839
http://git.kernel.org/stable/c/ad297cd2db8953e2202970e9504cab247b6c7cb4

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.