Vulnerability identifier: #VU96419

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4441

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the zynq_qspi_exec_mem_op() function in drivers/spi/spi-zynq-qspi.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/df14d2bed8e2455878e046e67123d9ecb2e79056
http://git.kernel.org/stable/c/2efece1368aeee2d2552c7ec36aeb676c4d4c95f
http://git.kernel.org/stable/c/3c32405d6474a21f7d742828e73c13e326dcae82
http://git.kernel.org/stable/c/b9dd08cbebe0c593c49bf86d2012a431494e54cb
http://git.kernel.org/stable/c/ab3824427b848da10e9fe2727f035bbeecae6ff4

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.