CVE-2021-47401: ipack: ipoctal: fix stack information leak
In the Linux kernel, the following vulnerability has been resolved:
ipack: ipoctal: fix stack information leak
The tty driver name is used also after registering the driver and must specifically not be allocated on the stack to avoid leaking information to user space (or triggering an oops).
Drivers should not try to encode topology information in the tty device name but this one snuck in through staging without anyone noticing and another driver has since copied this malpractice.
Fixing the ABI is a separate issue, but this at least plugs the security hole.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47401?
CVE-2021-47401 is classified as a medium-severity vulnerability in the Linux kernel.
How do I fix CVE-2021-47401?
To fix CVE-2021-47401, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What impact does CVE-2021-47401 have on systems running Linux?
CVE-2021-47401 may lead to information leakage from the kernel to user space, which could potentially be exploited.
Which versions of the Linux kernel are affected by CVE-2021-47401?
CVE-2021-47401 affects specific versions of the Linux kernel; check updated release notes for detailed information.
Is CVE-2021-47401 being actively exploited?
As of now, there is no public information indicating active exploitation of CVE-2021-47401.