Vulnerability identifier: #VU90297

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47288

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ngene_command_config_free_buf() function in drivers/media/pci/ngene/ngene-core.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/4487b968e5eacd02c493303dc2b61150bb7fe4b2
http://git.kernel.org/stable/c/c6ddeb63dd543b5474b0217c4e47538b7ffd7686
http://git.kernel.org/stable/c/e818f2ff648581a6c553ae2bebc5dcef9a8bb90c
http://git.kernel.org/stable/c/ec731c6ef564ee6fc101fc5d73e3a3a953d09a00
http://git.kernel.org/stable/c/e617fa62f6cf859a7b042cdd6c73af905ff8fca3
http://git.kernel.org/stable/c/e991457afdcb5f4dbc5bc9d79eaf775be33e7092
http://git.kernel.org/stable/c/b9a178f189bb6d75293573e181928735f5e3e070
http://git.kernel.org/stable/c/8d4abca95ecc82fc8c41912fa0085281f19cc29f

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.