Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 491

Export CSV
CVE-2021-3653

kernel: SVM nested virtualization issue in KVM (AVIC support)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 5 more
CVE-2021-3573

kernel: use-after-free in function hci_sock_bound_ioctl()

A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 1 more
CVE-2021-3564

kernel: double free in bluetooth subsystem when the HCI device initialization fails

A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 2 more
CVE-2021-33909

kernel: size_t-to-int conversion vulnerability in the filesystem layer

fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.

CVSS 3.1 · 7.8 High EPSS 9.8% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 4 more
Products
Debian Linux Fedora Linux Kernel and 13 more
CVE-2021-33034

kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan

In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 8 more
CVE-2021-33033

kernel: use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c

The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2021-29650

kernel: lack a full memory barrier upon the assignment of a new table value in net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h may lead to DoS

An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 2 more
CVE-2021-29154

kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 19 more
CVE-2021-27365

kernel: heap buffer overflow in the iSCSI subsystem

An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Debian Linux Netapp and 2 more
Products
Debian Linux Linux Kernel Cloud Backup and 10 more
CVE-2021-27364

kernel: out-of-bounds read in libiscsi module

An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 11 more
CVE-2021-27363

kernel: iscsi: unrestricted access to sessions and handles

An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel Cloud Backup and 7 more
CVE-2021-22543

Improper memory handling in Linux KVM

An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 26 more
CVE-2021-20265

kernel: increase slab leak leads to DoS

A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Oracle Redhat
Products
Linux Kernel Tekelec Platform Distribution Enterprise Linux and 2 more
CVE-2020-9383

kernel: out-of-bounds read in set_fdc in drivers/block/floppy.c

An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 13 more
CVE-2020-8649

kernel: invalid read location in vgacon_invert_region function in drivers/video/console/vgacon.c

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Opensuse and 1 more
Products
Debian Linux Linux Kernel Leap and 3 more
CVE-2020-8647

kernel: out-of-bounds read in in vc_do_resize function in drivers/tty/vt/vt.c

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Opensuse and 1 more
Products
Debian Linux Linux Kernel Leap and 3 more
CVE-2020-7053

kernel: use-after-free in i915_ppgtt_close in drivers/gpu/drm/i915/i915_gem_gtt.c

In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write) in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka CID-7dc40713618c. This is related to i915_gem_context_destroy_ioctl in drivers/gpu/drm/i915/i915_gem_context.c.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt