5.5

CVE-2021-3564

Exploit

A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13.

Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.13
Fedoraproject ≫ Fedora Version34
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.02% 0.032
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:N/I:N/A:P
CWE-415 Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

http://www.openwall.com/lists/oss-security/2021/05/25/1
Third Party Advisory
Exploit
Mailing List
https://bugzilla.redhat.com/show_bug.cgi?id=1964139
Third Party Advisory
Issue Tracking
https://www.openwall.com/lists/oss-security/2021/05/25/1
Third Party Advisory
Exploit
Mailing List