#VU91068 Use-after-free in Linux kernel - CVE-2021-47013

Vulnerability identifier: #VU91068

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47013

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the emac_mac_tx_buf_send() function in drivers/net/ethernet/qualcomm/emac/emac-mac.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/c7f75d11fe72913d2619f97b2334b083cd7bb955
http://git.kernel.org/stable/c/dc1b438a35773d030be0ee80d9c635c3e558a322
http://git.kernel.org/stable/c/16d8c44be52e3650917736d45f5904384a9da834
http://git.kernel.org/stable/c/55fcdd1258faaecca74b91b88cc0921f9edd775d
http://git.kernel.org/stable/c/9dc373f74097edd0e35f3393d6248eda8d1ba99d
http://git.kernel.org/stable/c/8c06f34785068b87e2b560534c77c163d6c6dca7
http://git.kernel.org/stable/c/e407495ba6788a67d1bd41714158c079e340879b
http://git.kernel.org/stable/c/6d72e7c767acbbdd44ebc7d89c6690b405b32b57

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.