#VU93083 Use of uninitialized resource in Linux kernel
Vulnerability identifier: #VU93083
Vulnerability risk: Low
CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-908
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to use of uninitialized resource within the reschedule_output_poll_work() and EXPORT_SYMBOL() functions in drivers/gpu/drm/drm_probe_helper.c, within the drm_mode_config_helper_suspend() and drm_mode_config_helper_resume() functions in drivers/gpu/drm/drm_modeset_helper.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel:
External links
http://git.kernel.org/stable/c/3d1b47e3a935abd4f258a945db87e7267ff4079c
http://git.kernel.org/stable/c/18451798f4a4e7418b9fad7e7dd313fe84b1f545
http://git.kernel.org/stable/c/5abffb66d12bcac84bf7b66389c571b8bb6e82bd
http://git.kernel.org/stable/c/786c27982a39d79cc753f84229eb5977ac8ef1c1
http://git.kernel.org/stable/c/4ad8d57d902fbc7c82507cfc1b031f3a07c3de6e
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
