Vulnerability identifier: #VU111460
Vulnerability risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-416
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the snd_pcm_buffer_access_unlock() function in sound/core/pcm_native.c, within the snd_pcm_oss_change_params_locked() function in sound/core/oss/pcm_oss.c. A local user can escalate privileges on the system.
Mitigation
Install update from vendor's repository.
Vulnerable software versions
Linux kernel: All versions
External links
https://git.kernel.org/stable/c/10217da9644ae75cea7330f902c35fc5ba78bbbf
https://git.kernel.org/stable/c/74d90875f3d43f3eff0e9861c4701418795d3455
https://git.kernel.org/stable/c/8170d8ec4efd0be352c14cb61f374e30fb0c2a25
https://git.kernel.org/stable/c/93a81ca0657758b607c3f4ba889ae806be9beb73
https://git.kernel.org/stable/c/afa56c960fcb4db37f2e3399f28e9402e4e1f470
https://git.kernel.org/stable/c/bf85e49aaf3a3c5775ea87369ea5f159c2148db4
https://git.kernel.org/stable/c/c0e05a76fc727929524ef24a19c302e6dd40233f
https://git.kernel.org/stable/c/f3e14d706ec18faf19f5a6e75060e140fea05d4a
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.