CVE-2021-45868

kernel: fs/quota/quota_tree.c does not validate the block number in the quota tree

In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300e H300e Firmware and 14 more

CVE-2021-45485

kernel: information leak in the IPv6 implementation

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Linux Netapp Oracle and 1 more

Products

Linux Kernel Aff A400 Aff A400 Firmware and 43 more

CVE-2021-45469

kernel: out-of-bounds memory access in __f2fs_setxattr() in fs/f2fs/xattr.c when an inode has an invalid last xattr entry

In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 16 more

CVE-2021-45100

kernel: ksmbd server communicates in cleartext even though encryption has been enabled due to a violation of the SMB protocol specification

The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has been enabled. This occurs because it sets the SMB2_GLOBAL_CAP_ENCRYPTION flag when using the SMB 3.1.1 protocol, which is a violation of the SMB protocol specification. When Windows 10 detects this protocol violation, it disables encryption.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ksmbd Project Linux Netapp

Products

Ksmbd Linux Kernel H300e and 15 more

CVE-2021-44733

kernel: use-after-free in the TEE subsystem

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 17 more

CVE-2021-43976

kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 3 more

Products

Debian Linux Fedora Linux Kernel and 21 more

CVE-2021-43057

kernel: use-after-free in the SELinux handler for PTRACE_TRACEME

An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300e H300e Firmware and 14 more

CVE-2021-42327

kernel: heap-based buffer overflow in dp_link_settings_write() in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c

dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Netapp

Products

Fedora Linux Kernel H300e and 15 more

CVE-2021-42252

kernel: memory overwrite in the kernel with potential privileges execution

An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel Cloud Backup H300e and 17 more

CVE-2021-42008

kernel: slab out-of-bounds write in decode_data() in drivers/net/hamradio/6pack.c

The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.

CVSS 3.1 · 7.8 High EPSS 1.6% KEV · Not listed

Vendors

Debian Linux Netapp

Products

Debian Linux Linux Kernel H300e and 17 more

CVE-2021-41864

kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 22 more

CVE-2021-41073

kernel: local user privilege escalation via loop_rw_iter in fs/io_uring.c

loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 18 more

CVE-2021-3772

kernel: sctp: Invalid chunks may be used to remotely remove existing associations

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Linux Netapp and 2 more

Products

Debian Linux Linux Kernel E-series Santricity Os Controller and 23 more

CVE-2021-3760

kernel: nfc: Use-After-Free vulnerability of ndev->rf_conn_info object

A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 16 more

CVE-2021-3753

kernel: a race out-of-bound read in vt

A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Active Iq Unified Manager Bootstrap Os and 15 more

CVE-2021-3752

kernel: possible use-after-free in bluetooth module

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 7.1 High EPSS 1.7% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 3 more

Products

Debian Linux Fedora Linux Kernel and 25 more

CVE-2021-3743

kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Netapp and 2 more

Products

Fedora Linux Kernel H300e and 19 more

CVE-2021-3739

kernel: null-ptr-dereference bug in btrfs_rm_device in fs/btrfs/volumes.c

A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’. This flaw allows a local attacker to crash the system or leak kernel internal information. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Netapp

Products

Fedora Linux Kernel H300e and 15 more

CVE-2021-3640

kernel: use-after-free vulnerability in function sco_sock_sendmsg()

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 20 more

CVE-2021-3612

kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP()

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 3 more

Products

Debian Linux Fedora Linux Kernel and 23 more