#VU90953 Improper error handling in Linux kernel - CVE-2021-47161
Vulnerability identifier: #VU90953
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-47161
CWE-ID:
CWE-388
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper error handling within the dspi_probe() function in drivers/spi/spi-fsl-dspi.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: All versions
External links
https://git.kernel.org/stable/c/10a089bae827ec30ad9b6cb7048020a62fae0cfa
https://git.kernel.org/stable/c/00450ed03a17143e2433b461a656ef9cd17c2f1d
https://git.kernel.org/stable/c/15d1cc4b4b585f9a2ce72c52cca004d5d735bdf1
https://git.kernel.org/stable/c/fe6921e3b8451a537e01c031b8212366bb386e3e
https://git.kernel.org/stable/c/12391be4724acc9269e1845ccbd881df37de4b56
https://git.kernel.org/stable/c/680ec0549a055eb464dce6ffb4bfb736ef87236e
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
