Vulnerability identifier: #VU93307
Vulnerability risk: Low
CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-119
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to memory corruption within the scp_elf_read_ipi_buf_addr() and scp_ipi_init() functions in drivers/remoteproc/mtk_scp.c. A local user can escalate privileges on the system.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel:
External links
http://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf
http://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2
http://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e
http://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf
http://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9
http://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.