PT-2024-11482 · Linux+3 · Linux Kernel+3
Zhou Qingyang
·
Published
2021-12-01
·
Updated
2024-08-19
·
CVE-2021-47537
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A memory leak bug was found in the
rvu mbox init() function, where mbox regions is not freed or passed out under the switch-default region. This bug was identified by a static analyzer using differential checking to detect inconsistent security operations between two code paths. The analysis confirmed that the inconsistent operations are not recovered in the current function or its callers, constituting a bug. The bug can be fixed by changing 'return err' to 'goto free regions'. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse