#VU91437 Buffer overflow in Linux kernel
Vulnerability identifier: #VU91437
Vulnerability risk: Low
CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-119
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to memory corruption within the persistent_ram_init_ecc() function in fs/pstore/ram_core.c. A local user can escalate privileges on the system.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel:
External links
http://git.kernel.org/stable/c/3b333cded94fbe5ce30d699b316c4715151268ae
http://git.kernel.org/stable/c/d1fe1aede684bd014714dacfdc75586a9ad38657
http://git.kernel.org/stable/c/acd413da3e1f37582207cd6078a41d57c9011918
http://git.kernel.org/stable/c/8fb12524c86bdd542a54857d5d076b1b6778c78c
http://git.kernel.org/stable/c/48dcfc42ce705b652c0619cb99846afc43029de9
http://git.kernel.org/stable/c/a34946ec3de88a16cc3a87fdab50aad06255a22b
http://git.kernel.org/stable/c/f9b891a7e8fcf83901f8507241e23e7420103b61
http://git.kernel.org/stable/c/86222a8fc16ec517de8da2604d904c9df3a08e5d
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
