Vulnerability identifier: #VU92997

Vulnerability risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47060

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor:

Description

The vulnerability allows a local privileged user to execute arbitrary code on the target system.

The vulnerability exists due to a NULL pointer dereference error. A local privileged user can pass specially crafted data to the application and execute arbitrary code on the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

---

External links
http://git.kernel.org/stable/c/7d1bc32d6477ff96a32695ea4be8144e4513ab2d
http://git.kernel.org/stable/c/2a20592baff59c5351c5200ec667e1a2aa22af85
http://git.kernel.org/stable/c/168e82f640ed1891a700bdb43e37da354b2ab63c
http://git.kernel.org/stable/c/50cbad42bfea8c052b7ca590bd4126cdc898713c
http://git.kernel.org/stable/c/5d3c4c79384af06e3c8e25b7770b6247496b4417

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.