#VU91338 Information disclosure in Linux kernel - CVE-2021-47425

Vulnerability identifier: #VU91338

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47425

CWE-ID: CWE-200

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the i2c_acpi_notify() function in drivers/i2c/i2c-core-acpi.c. A local user can gain access to sensitive information.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/b8090a84d7758b929d348bafbd86bb7a10c5fb63
https://git.kernel.org/stable/c/3d9d458a8aaafa47268ea4f1b4114a9f12927989
https://git.kernel.org/stable/c/60bacf259e8c2eb2324f3e13275200baaee9494b
https://git.kernel.org/stable/c/f86de018fd7a24ee07372d55ffa7824f0c674a95
https://git.kernel.org/stable/c/90f1077c9184ec2ae9989e4642f211263f301694
https://git.kernel.org/stable/c/6558b646ce1c2a872fe1c2c7cb116f05a2c1950f

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.