7.8
CVE-2021-33909
- EPSS 9.73%
- Veröffentlicht 20.07.2021 19:15:09
- Zuletzt bearbeitet 21.11.2024 06:09:45
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.12.43 < 3.13
Linux ≫ Linux Kernel Version >= 3.16 < 4.4.276
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.276
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.240
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.198
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.134
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.52
Linux ≫ Linux Kernel Version >= 5.11 < 5.12.19
Linux ≫ Linux Kernel Version >= 5.13 < 5.13.4
Fedoraproject ≫ Fedora Version34
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Netapp ≫ Hci Management Node Version-
Oracle ≫ Communications Session Border Controller Version8.2
Oracle ≫ Communications Session Border Controller Version8.3
Oracle ≫ Communications Session Border Controller Version8.4
Oracle ≫ Communications Session Border Controller Version9.0
Sonicwall ≫ Sma1000 Firmware Version <= 12.4.2-02044
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 9.73% | 0.949 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.2 | 3.9 | 10 |
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
CWE-190 Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-787 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
https://www.oracle.com/security-alerts/cpujan2022.html
http://www.openwall.com/lists/oss-security/2021/09/17/2
http://www.openwall.com/lists/oss-security/2021/09/17/4
http://www.openwall.com/lists/oss-security/2021/09/21/1
https://lists.debian.org/debian-lts-announce/2021/07/msg00015.html
https://www.debian.org/security/2021/dsa-4941
http://www.openwall.com/lists/oss-security/2021/07/22/7
https://lists.debian.org/debian-lts-announce/2021/07/msg00014.html
https://lists.debian.org/debian-lts-announce/2021/07/msg00016.html
http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.html
http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html
http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html
http://packetstormsecurity.com/files/163671/Kernel-Live-Patch-Security-Notice-LSN-0079-1.html
http://www.openwall.com/lists/oss-security/2021/08/25/10
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4
https://github.com/torvalds/linux/commit/8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4UHHIGISO3FVRF4CQNJS4IKA25ATSFU/
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015
https://security.netapp.com/advisory/ntap-20210819-0004/
https://www.openwall.com/lists/oss-security/2021/07/20/1