#VU93003 Release of invalid pointer or reference in Linux kernel - CVE-2021-47087

Vulnerability identifier: #VU93003

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47087

CWE-ID: CWE-763

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to modify data on the system.

The vulnerability exists due to performance of perform __free_pages(page, order) using this pointer as we would free any arbitrary pages. A local user can modify data on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/806142c805cacd098e61bdc0f72c778a2389fe4a
https://git.kernel.org/stable/c/ad338d825e3f7b96ee542bf313728af2d19fe9ad
https://git.kernel.org/stable/c/91e94e42f6fc49635f1a16d8ae3f79552bcfda29
https://git.kernel.org/stable/c/18549bf4b21c739a9def39f27dcac53e27286ab5

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.