#VU90583 NULL pointer dereference in Linux kernel - CVE-2021-47207

Vulnerability identifier: #VU90583

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47207

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the snd_gf1_dma_interrupt() function in sound/isa/gus/gus_dma.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/3e28e083dcdf03a18a083f8a47b6bb6b1604b5be
https://git.kernel.org/stable/c/cb09c760c201f82df83babc92a5ffea0a01807fc
https://git.kernel.org/stable/c/542fa721594a02d2aee0370a764d306ef48d030c
https://git.kernel.org/stable/c/ab4c1ebc40f699f48346f634d7b72b9c5193f315
https://git.kernel.org/stable/c/c6d2cefdd05c4810c416fb8d384b5c377bd977bc
https://git.kernel.org/stable/c/1ac6cd87d8ddd36c43620f82c4d65b058f725f0f
https://git.kernel.org/stable/c/16721797dcef2c7c030ffe73a07f39a65f9323c3
https://git.kernel.org/stable/c/a0d21bb3279476c777434c40d969ea88ca64f9aa

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.