#VU90225 Use-after-free in Linux kernel - CVE-2021-47118

Vulnerability identifier: #VU90225

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47118

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kernel_init_freeable() function in init/main.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/764c2e892d1fe895392aff62fb353fdce43bb529
http://git.kernel.org/stable/c/f86c80515a8a3703e0ca2e56deb50fc2879c5ea4
http://git.kernel.org/stable/c/4dbd8808a591b49b717862e6e0081bcf14a87788
http://git.kernel.org/stable/c/d106f05432e60f9f62d456ef017687f5c73cb414
http://git.kernel.org/stable/c/2cd6eedfa6344f5ef5c3dac3aee57a39b5b46dff
http://git.kernel.org/stable/c/7178be006d495ffb741c329012da289b62dddfe6
http://git.kernel.org/stable/c/b8ff869f20152fbe66b6c2e2715d26a2f9897cca
http://git.kernel.org/stable/c/0711f0d7050b9e07c44bc159bbc64ac0a1022c7f

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.