Resource management error in Linux kernel pci host driver

1) Resource management error

EUVDB-ID: #VU93455

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47229

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the advk_pcie_wait_pio(), advk_pcie_rd_conf() and advk_pcie_wr_conf() functions in drivers/pci/host/pci-aardvark.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.14 - 5.13 rc5

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:4.14:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.14.0:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.14.0:rc1:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.14.1:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.14.2:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.14.3:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.14.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.14.5:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.14.6:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.14.7:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/400e6b1860c8be61388d0b77814c53260f96e17a
https://git.kernel.org/stable/c/b00a9aaa4be20ad6e3311fb78a485eae0899e89a
https://git.kernel.org/stable/c/4c90f90a91d75c3c73dd633827c90e8746d9f54d
https://git.kernel.org/stable/c/1a1dbc4473974867fe8c5f195c17b341c8e82867
https://git.kernel.org/stable/c/3d213a4ddf49a860be6e795482c17f87e0c82b2a
https://git.kernel.org/stable/c/f18139966d072dab8e4398c95ce955a9742e04f7
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.240
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.198
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.46
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.13
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.128

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.