Errata ALT-PU-2021-1990-1: Information
Fixes
Published: May 11, 2021
BDU:2021-02663
Уязвимость набора стандартов связи для коммуникации IEEE 802.11 операционной системы Windows, позволяющая нарушителю внедрить произвольные сетевые пакеты
Severity: LOW (3.5) Vector: AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Links:
Published: May 11, 2021
BDU:2021-02665
Уязвимость реализации алгоритмов WPA и WPA2 драйвера 6.1316.1209 Wi-Fi адаптера ALFA, позволяющая нарушителю внедрить и расшифровать пакеты в сетях WPA или WPA2
Severity: MEDIUM (6.5) Vector: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Links:
Published: May 11, 2021
BDU:2021-03088
Уязвимость реализации алгоритмов WPA, WPA2 и WPA3 набора стандартов связи для коммуникации IEEE 802.11, позволяющая нарушителю оказать воздействие на целостность защищаемой информации
Severity: MEDIUM (6.5) Vector: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Links:
Published: May 11, 2021
BDU:2021-03095
Уязвимость реализации алгоритмов WEP, WPA, WPA2 и WPA3 набора стандартов связи для коммуникации IEEE 802.11, позволяющая нарушителю внедрить произвольные сетевые пакеты и/или оказать воздействие на целостность защищаемой информации
Severity: MEDIUM (4.6) Vector: AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Links:
Published: May 11, 2021
BDU:2021-03175
Уязвимость реализации алгоритмов WEP, WPA, WPA2 и WPA3 ядра операционной системы Linux, позволяющая нарушителю внедрить произвольные сетевые пакеты независимо от конфигурации сети
Severity: MEDIUM (5.3) Vector: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Links:
Published: May 11, 2021
BDU:2021-03177
Уязвимость реализации алгоритмов WEP, WPA, WPA2 и WPA3 ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на целостность защищаемой информации
Severity: MEDIUM (5.3) Vector: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Links:
Published: April 30, 2021
BDU:2021-03220
Уязвимость подсистемы BPF ядра операционных систем Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Severity: MEDIUM (5.5) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Links:
Published: Aug. 8, 2021
BDU:2021-04152
Уязвимость компонента net/nfc/llcp_sock.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Severity: MEDIUM (5.5) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Links:
Published: May 11, 2021
BDU:2021-04607
Уязвимость функции isotp_setsockopt компонента net/can/isotp.c ядра операционной системы Linux, связанная с использованием памяти после её освобождения, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: June 4, 2021
BDU:2021-04825
Уязвимость функции bpf_ringbuf_reserve() ядра операционной системы Linux , связанная с записью за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код в контексте ядра
Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: May 27, 2021
BDU:2021-04827
Уязвимость компонент kernel/bpf/verifier.c ядра операционной системы Linux, позволяющая нарушителю повысить свои привилегии до уровня root
Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: Aug. 8, 2021
BDU:2021-04837
Уязвимость параметров NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, и NF_SYSCTL_CT_BUCKETS компонента net/netfilter/nf_conntrack_standalone.c ядра операционной системы Linux, позволяющая нарушителю раскрыть защищаемую информацию
Severity: LOW (3.3) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Links:
Published: May 10, 2021
BDU:2021-04838
Уязвимость компонента net/bluetooth/hci_request.c операционной системы Linux, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (7.0) Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: May 14, 2021
BDU:2021-04839
Уязвимость структуры hci_chan компонента net/bluetooth/hci_event.c ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: June 4, 2021
BDU:2021-04842
Уязвимость подсистемы eBPF ядра операционной системы Linux , связанная с чтением за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код в контексте ядра
Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: June 4, 2021
BDU:2021-04843
Уязвимость подсистемы io_uring ядра операционной системы Linux, связанная с записью за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8) Vector: AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Links:
Published: April 22, 2021
BDU:2021-04855
Уязвимость компонента net/sctp/socket.c ядра операционной системы Linux, позволяющая нарушителю повысить свои привилегии
Severity: HIGH (7.0) Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: May 12, 2021
BDU:2021-04856
Уязвимость сокетов nfc операционной системы Linux , связанная с использованием памяти после её освобождения, позволяющая нарушителю повысить свои привилегии
Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: May 17, 2021
BDU:2021-04862
Уязвимость функции hci_dev_do_open() подсистемы инициализации устройства HCI ядра операционной системы Linux, связанная с повторным освобождением памяти, позволяющая нарушителю вызвать отказ в обслуживании
Severity: MEDIUM (5.5) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Links:
Published: April 14, 2021
BDU:2022-00208
Уязвимость программной объектной сети хранения ceph, связанная с недостатками процедуры аутентификации, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Severity: HIGH (7.2) Vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Links:
Published: March 24, 2021
BDU:2022-00613
Уязвимость реализации протокола IPv4 ядра операционных систем Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Severity: MEDIUM (5.9) Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Links:
Published: Dec. 20, 2021
BDU:2022-04604
Уязвимость функции decode_nfs_fh() ядра операционной системы Linux, позволяющая нарушителю повысить свои привилегии и вызвать аварийное завершение системы
Severity: HIGH (8.0) Vector: AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: May 11, 2021
Modified: April 2, 2023
Modified: April 2, 2023
CVE-2020-24586
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
Severity: LOW (3.5) Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Links:
- https://www.fragattacks.com
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- [oss-security] 20210511 various 802.11 security issues - fragattacks.com
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
- 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
- [debian-lts-announce] 20230401 [SECURITY] [DLA 3380-1] firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)
Published: May 11, 2021
Modified: April 2, 2023
Modified: April 2, 2023
CVE-2020-24587
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.
Severity: LOW (2.6) Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Links:
- https://www.fragattacks.com
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- [oss-security] 20210511 various 802.11 security issues - fragattacks.com
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
- 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
- [debian-lts-announce] 20230401 [SECURITY] [DLA 3380-1] firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)
Published: May 11, 2021
Modified: April 2, 2023
Modified: April 2, 2023
CVE-2020-24588
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.
Severity: LOW (3.5) Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Links:
- https://www.fragattacks.com
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- [oss-security] 20210511 various 802.11 security issues - fragattacks.com
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
- 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
- [debian-lts-announce] 20230401 [SECURITY] [DLA 3380-1] firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)
Published: May 11, 2021
Modified: April 22, 2022
Modified: April 22, 2022
CVE-2020-26141
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol.
Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Links:
- https://www.fragattacks.com
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- [oss-security] 20210511 various 802.11 security issues - fragattacks.com
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
- 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
Published: May 11, 2021
Modified: May 13, 2022
Modified: May 13, 2022
CVE-2020-26145
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Links:
Published: May 11, 2021
Modified: July 12, 2022
Modified: July 12, 2022
CVE-2020-26147
An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
Severity: MEDIUM (5.4) Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
Links:
- https://www.fragattacks.com
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- [oss-security] 20210511 various 802.11 security issues - fragattacks.com
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
- 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
Published: April 15, 2021
Modified: Feb. 16, 2024
Modified: Feb. 16, 2024
CVE-2021-20288
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Severity: HIGH (7.2) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Links:
Published: April 22, 2021
Modified: Nov. 7, 2023
Modified: Nov. 7, 2023
CVE-2021-23133
A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.
Severity: HIGH (7.0) Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b166a20b07382b8bc1dcee2a448715c9c2c81b5b
- https://www.openwall.com/lists/oss-security/2021/04/18/2
- [oss-security] 20210510 Re: CVE-2021-23133: Linux kernel: race condition in sctp sockets
- [oss-security] 20210510 Re: CVE-2021-23133: Linux kernel: race condition in sctp sockets
- [oss-security] 20210510 Re: CVE-2021-23133: Linux kernel: race condition in sctp sockets
- [oss-security] 20210510 Re: CVE-2021-23133: Linux kernel: race condition in sctp sockets
- https://security.netapp.com/advisory/ntap-20210611-0008/
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
- FEDORA-2021-8cd093f639
- FEDORA-2021-e6b4847979
- FEDORA-2021-a963f04012
Published: May 13, 2021
Modified: Nov. 7, 2023
Modified: Nov. 7, 2023
CVE-2021-23134
Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=c61760e6940d
- https://www.openwall.com/lists/oss-security/2021/05/11/4
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
- https://security.netapp.com/advisory/ntap-20210625-0007/
- FEDORA-2021-286375de1e
- FEDORA-2021-05152dbcf5
Published: June 29, 2021
Modified: April 6, 2022
Modified: April 6, 2022
CVE-2021-28691
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: May 6, 2021
Modified: Nov. 7, 2023
Modified: Nov. 7, 2023
CVE-2021-31829
kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized data that might represent sensitive information previously operated on by the kernel.
Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Links:
Published: May 11, 2021
Modified: May 13, 2022
Modified: May 13, 2022
CVE-2021-32399
net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.
Severity: HIGH (7.0) Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
- https://github.com/torvalds/linux/commit/e2cb6b891ad2b8caa9131e3be70f45243df82a80
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e2cb6b891ad2b8caa9131e3be70f45243df82a80
- [oss-security] 20210511 CVE-2021-32399 Linux device detach race condition
- https://security.netapp.com/advisory/ntap-20210622-0006/
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
Published: May 12, 2021
Modified: March 25, 2024
Modified: March 25, 2024
CVE-2021-32606
In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.)
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
- https://www.openwall.com/lists/oss-security/2021/05/11/16
- [oss-security] 20210512 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation
- [oss-security] 20210514 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation
- [oss-security] 20210514 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation
- [oss-security] 20210528 Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation
- https://security.netapp.com/advisory/ntap-20210625-0001/
- FEDORA-2021-4f852b79d1
- FEDORA-2021-bae582b42c
- FEDORA-2021-8832eab899
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2b17c400aeb44daf041627722581ade527bb3c1d
Published: May 15, 2021
Modified: Nov. 7, 2023
Modified: Nov. 7, 2023
CVE-2021-33034
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5c4c8c9544099bb9043a10a5318130a943e32fc3
- https://syzkaller.appspot.com/bug?id=2e1943a94647f7732dd6fc60368642d6e8dc91b1
- https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-hci_send_acl
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
- FEDORA-2021-bae582b42c
Published: May 27, 2021
Modified: March 25, 2024
Modified: March 25, 2024
CVE-2021-33200
kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
- https://www.openwall.com/lists/oss-security/2021/05/27/1
- https://security.netapp.com/advisory/ntap-20210706-0004/
- FEDORA-2021-0b35886add
- FEDORA-2021-646098b5b8
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3d0220f6861d713213b015b582e9f21e5b28d2e0
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bb01a1bba579b4b1c5566af24d95f1767859771e
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a7036191277f9fa68d92f2071ddc38c09b1e5ee5
Published: June 4, 2021
Modified: Sept. 14, 2021
Modified: Sept. 14, 2021
CVE-2021-3489
The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
- https://www.zerodayinitiative.com/advisories/ZDI-21-590/
- https://ubuntu.com/security/notices/USN-4949-1
- https://ubuntu.com/security/notices/USN-4950-1
- https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=4b81ccebaeee885ab1aa1438133f2991e3a2b6ea
- [oss-security] CVE-2021-3489 - Linux kernel eBPF RINGBUF map oversized allocation
- https://security.netapp.com/advisory/ntap-20210716-0004/
Published: June 4, 2021
Modified: Sept. 14, 2021
Modified: Sept. 14, 2021
CVE-2021-3490
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
- https://ubuntu.com/security/notices/USN-4949-1
- https://www.zerodayinitiative.com/advisories/ZDI-21-606/
- https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e
- https://ubuntu.com/security/notices/USN-4950-1
- [oss-security] CVE-2021-3490 - Linux kernel eBPF bitwise ops ALU32 bounds tracking
- https://security.netapp.com/advisory/ntap-20210716-0004/
- http://packetstormsecurity.com/files/164015/Linux-eBPF-ALU32-32-bit-Invalid-Bounds-Tracking-Local-Privilege-Escalation.html
Published: June 4, 2021
Modified: Sept. 14, 2021
Modified: Sept. 14, 2021
CVE-2021-3491
The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).
Severity: HIGH (8.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Links:
- https://ubuntu.com/security/notices/USN-4949-1
- https://ubuntu.com/security/notices/USN-4950-1
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d1f82808877bb10d3deee7cf3374a4eb3fb582db
- https://www.zerodayinitiative.com/advisories/ZDI-21-589/
- [oss-security] CVE-2021-3491 - Linux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypass
- https://security.netapp.com/advisory/ntap-20210716-0004/
Published: June 8, 2021
Modified: Feb. 13, 2023
Modified: Feb. 13, 2023
CVE-2021-3564
A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13.
Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Links:
- https://bugzilla.redhat.com/show_bug.cgi?id=1964139
- [oss-security] 20210601 Re: CVE-2021-3564 Linux Bluetooth device initialization implementation bug
- [oss-security] 20210525 CVE-2021-3564 Linux Bluetooth device initialization implementation bug
- https://www.openwall.com/lists/oss-security/2021/05/25/1
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
Published: Aug. 8, 2021
Modified: Sept. 21, 2021
Modified: Sept. 21, 2021
CVE-2021-38208
net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call.
Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Links:
- https://github.com/torvalds/linux/commit/4ac06a1e013cf5fdd963317ffd3b968560f33bba
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.10
- [oss-security] 20210817 Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname
- [oss-security] 20210817 Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname
- https://bugzilla.redhat.com/show_bug.cgi?id=1992810
- [oss-security] 20210824 Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname
Published: Aug. 8, 2021
Modified: Aug. 13, 2021
Modified: Aug. 13, 2021
CVE-2021-38209
net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls.
Severity: LOW (3.3) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Links:
Published: March 25, 2022
Modified: Nov. 7, 2023
Modified: Nov. 7, 2023
CVE-2021-4157
An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system.
Severity: HIGH (8.0) Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: Dec. 25, 2021
Modified: Feb. 24, 2023
Modified: Feb. 24, 2023
CVE-2021-45486
In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.
Severity: LOW (3.5) Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Links: