Improper Initialization in Linux kernel hardware mISDN driver

1) Improper Initialization

EUVDB-ID: #VU91550

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47284

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the nj_probe() function in drivers/isdn/hardware/mISDN/netjet.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.4 - 5.13 rc5

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:4.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.0:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.0-57:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.1:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.2:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.3:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.5:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.6:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.7:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/958cb1078ca60d214826fd90a0961a447fade59a
https://git.kernel.org/stable/c/4c1fcb6ec964b44edbf84235134582a5ffae1521
https://git.kernel.org/stable/c/a0a37e4454ca1c0b424edc2c9c2487c2c46a1be6
https://git.kernel.org/stable/c/bf78e25bd3f487208e042c67c8a31706c2dba265
https://git.kernel.org/stable/c/9d7d4649dc1c53acf76df260fd519db698ed20d7
https://git.kernel.org/stable/c/143fc7220961220eecc04669e5909af8847bf8c8
https://git.kernel.org/stable/c/6249193e03709ea625e10706ecaf17fea0427d3d
https://git.kernel.org/stable/c/9f6f852550d0e1b7735651228116ae9d300f69b3
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.237
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.195
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.273
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.273
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.44
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.11
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.126

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.