#VU91095 Out-of-bounds read in Linux kernel
Vulnerability identifier: #VU91095
Vulnerability risk: Low
CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-125
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds read error within the apply_dcb_encoder_quirks() and fabricate_dcb_encoder_table() functions in drivers/gpu/drm/nouveau/nouveau_bios.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel:
External links
http://git.kernel.org/stable/c/df0991da7db846f7fa4ec6740350f743d3b69b04
http://git.kernel.org/stable/c/5fd4b090304e450aa0e7cc9cc2b4873285c6face
http://git.kernel.org/stable/c/6690cc2732e2a8d0eaca44dcbac032a4b0148042
http://git.kernel.org/stable/c/26212da39ee14a52c76a202c6ae5153a84f579a5
http://git.kernel.org/stable/c/cf92bb778eda7830e79452c6917efa8474a30c1e
http://git.kernel.org/stable/c/c2b97f26f081ceec3298151481687071075a25cb
http://git.kernel.org/stable/c/5050ae879a828d752b439e3827aac126709da6d1
http://git.kernel.org/stable/c/097c7918fcfa1dee233acfd1f3029f00c3bc8062
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
