Vulnerability identifier: #VU93189

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47387

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sugov_tunables_free(), sugov_tunables_alloc(), sugov_init() and sugov_exit() functions in kernel/sched/cpufreq_schedutil.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/cb4a53ba37532c861a5f3f22803391018a41849a
http://git.kernel.org/stable/c/463c46705f321201090b69c4ad5da0cd2ce614c9
http://git.kernel.org/stable/c/30d57cf2c4116ca6d34ecd1cac94ad84f8bc446c
http://git.kernel.org/stable/c/67c98e023135ff81b8d52998a6fdb8ca0c518d82
http://git.kernel.org/stable/c/a7d4fc84404d45d72f4490417e8cc3efa4af93f1
http://git.kernel.org/stable/c/8d62aec52a8c5b1d25a2364b243fcc5098a2ede9
http://git.kernel.org/stable/c/e5c6b312ce3cc97e90ea159446e6bfa06645364d

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.