CVE-2021-47401

MEDIUM

Linux Kernel 3.5-4.4.286 - Unprotected Kernel Memory Exposure via TTY Driver Name

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix stack information leak The tty driver name is used also after registering the driver and must specifically not be allocated on the stack to avoid leaking information to user space (or triggering an oops). Drivers should not try to encode topology information in the tty device name but this one snuck in through staging without anyone noticing and another driver has since copied this malpractice. Fixing the ABI is a separate issue, but this at least plugs the security hole.

Scores

CVSS v3 5.5
EPSS 0.0024
EPSS Percentile 15.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-668
Status published
Products (20)
Linux/Linux < 3.5
Linux/Linux 3.5
Linux/Linux 4.14.249 - 4.14.*
Linux/Linux 4.19.209 - 4.19.*
Linux/Linux 4.4.286 - 4.4.*
Linux/Linux 4.9.285 - 4.9.*
Linux/Linux 5.10.71 - 5.10.*
Linux/Linux 5.14.10 - 5.14.*
Linux/Linux 5.15
Linux/Linux 5.4.151 - 5.4.*
... and 10 more
Published May 21, 2024
Tracked Since Feb 18, 2026