Vulnerability identifier: #VU93847
Vulnerability risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-399
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to resource management error within the smb2_get_enc_key() function in fs/cifs/smb2ops.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel:
External links
http://git.kernel.org/stable/c/e94851629c49c65b4fbb29a5725ddfd7988f8f20
http://git.kernel.org/stable/c/e486f8397f3f14a7cadc166138141fdb14379a54
http://git.kernel.org/stable/c/93f3339b22ba17e66f0808737467b70ba087eaec
http://git.kernel.org/stable/c/aaa0faa5c28a91c362352d6b35dc3ed10df56fb0
http://git.kernel.org/stable/c/f59a9242942fef0de7b926e438ba4eae65d4b4dd
http://git.kernel.org/stable/c/b399c1a3ea0b9d10047ff266d65533df7f15532f
http://git.kernel.org/stable/c/83728cbf366e334301091d5b808add468ab46b27
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.