PT-2024-8924 · Linux+3 · Linux Kernel+3
Hulk Robot
·
Published
2024-05-22
·
Updated
2025-01-06
·
CVE-2021-47499
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue is related to a possible memory leak in the Linux kernel, specifically in the kxcjk-1013 driver. When the ACPI type is ACPI SMO8500, the data->dready trig will not be set, and the memory allocated by iio triggered buffer setup() will not be freed, causing a memory leak. The memory leak can be identified by an unreferenced object, and a backtrace is provided to show the call stack leading to the leak. The issue can be fixed by removing the data->dready trig condition in the probe and remove functions.
Recommendations:
To resolve the issue, remove the data->dready trig condition in the probe and remove functions. As a temporary workaround, consider disabling the kxcjk1013 probe() function until a patch is available. Restrict access to the vulnerable module kxcjk 1013 to minimize the risk of exploitation. Avoid using the iio triggered buffer setup() function in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse