Memory leak in Linux kernel ipv4

1) Memory leak

EUVDB-ID: #VU89948

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47238

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ip_mc_destroy_dev() function in net/ipv4/igmp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.9 - 5.13 rc5

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:4.9:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.0:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.1:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.2:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.3:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.5:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.6:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.7:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.8:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/0dc13e75507faa17ac9f7562b4ef7bf8fcd78422
https://git.kernel.org/stable/c/6cff57eea3347f79f1867cc53e1093b6614138d8
https://git.kernel.org/stable/c/1e28018b5c83d5073f74a6fb72eabe8370b2f501
https://git.kernel.org/stable/c/3dd2aeac2e9624cff9fa634710837e4f2e352758
https://git.kernel.org/stable/c/ac31cc837cafb57a271babad8ccffbf733caa076
https://git.kernel.org/stable/c/77de6ee73f54a9a89c0afa0bf4c53b239aa9953a
https://git.kernel.org/stable/c/d8e2973029b8b2ce477b564824431f3385c77083
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.238
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.196
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.274
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.46
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.13
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.128

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.