7.8

CVE-2021-4197

EPSS 0.54%
Veröffentlicht 23.03.2022 20:15:10
Zuletzt bearbeitet 21.11.2024 06:37:07
Erkennungen
Login

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 9

NVD 15 VulnDex Vulnerability Enrichment 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linux ≫ Linux Kernel Version >= 4.2 < 4.14.276

Linux ≫ Linux Kernel Version >= 4.15 < 4.19.238

Linux ≫ Linux Kernel Version >= 4.20 < 5.4.189

Linux ≫ Linux Kernel Version >= 5.5 < 5.10.111

Linux ≫ Linux Kernel Version >= 5.11 < 5.15.14

Oracle ≫ Communications Cloud Native Core Binding Support Function Version 22.1.1

Oracle ≫ Communications Cloud Native Core Binding Support Function Version 22.1.3

Oracle ≫ Communications Cloud Native Core Binding Support Function Version 22.2.0

Debian ≫ Debian Linux Version 10.0

Broadcom ≫ Brocade Fabric Operating System Firmware Version -

Netapp ≫ H300s Firmware Version -

Netapp ≫ H300s Version -

Netapp ≫ H500s Firmware Version -

Netapp ≫ H500s Version -

Netapp ≫ H700s Firmware Version -

Netapp ≫ H700s Version -

Netapp ≫ H410s Firmware Version -

Netapp ≫ H410s Version -

Netapp ≫ H410c Firmware Version -

Netapp ≫ H410c Version -

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.54%	0.422

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST	7.2	3.9	10	AV:L/AC:L/Au:N/C:C/I:C/A:C

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://www.oracle.com/security-alerts/cpujul2022.html

Third Party Advisory

https://www.debian.org/security/2022/dsa-5127

Third Party Advisory

https://www.debian.org/security/2022/dsa-5173

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2035652

Third Party Advisory

Issue Tracking

https://lore.kernel.org/lkml/20211209214707.805617-1-tj%40kernel.org/T/

https://security.netapp.com/advisory/ntap-20220602-0006/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2021-4197

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-4197

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-4197

EUVD