Privilege escalation in Linux kernel ACPI

1) Use-after-free

EUVDB-ID: #VU88893

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46966

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cm_write() function in drivers/acpi/custom_method.c. A local user can trigger a use-after-free error and escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/1d53ca5d131074c925ce38361fb0376d3bf7e394
http://git.kernel.org/stable/c/8b04d57f30caf76649d0567551589af9a66ca9be
http://git.kernel.org/stable/c/90575d1d9311b753cf1718f4ce9061ddda7dfd23
http://git.kernel.org/stable/c/a5b26a2e362f572d87e9fd35435680e557052a17
http://git.kernel.org/stable/c/72814a94c38a33239793f7622cec6ace1e540c4b
http://git.kernel.org/stable/c/62dc2440ebb552aa0d7f635e1697e077d9d21203
http://git.kernel.org/stable/c/f16737caf41fc06cfe6e49048becb09657074d4b
http://git.kernel.org/stable/c/b7a5baaae212a686ceb812c32fceed79c03c0234
http://git.kernel.org/stable/c/e483bb9a991bdae29a0caa4b3a6d002c968f94aa

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.