Vulnerability identifier: #VU57040

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-29647

CWE-ID: CWE-200

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to an error in qrtr_recvmsg(0 function in net/qrtr/qrtr.c caused by a partially uninitialized data structure. A local user can read sensitive information from kernel memory.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel: 5.11 - 5.11.9

---

CPE

• cpe:2.3:o:linux_foundation:linux_kernel:5.11.1:*:*:*:*:*:*:*

External links
http://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.11
http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=50535249f624d0072cd885bcdce4e4b6fb770160
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WKRNELXLVFDY6Y5XDMWLIH3VKIMQXLLR/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RZGMUP6QEHJJEKPMLKOSPWYMW7PXFC2M/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VTADK5ELGTATGW2RK3K5MBJ2WGYCPZCM/
http://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
http://lists.debian.org/debian-lts-announce/2021/06/msg00020.html

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?