Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6,068

Export CSV
CVE-2021-3656

kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel 3scale Api Management and 28 more
CVE-2021-3653

kernel: SVM nested virtualization issue in KVM (AVIC support)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 5 more
CVE-2021-3640

kernel: use-after-free vulnerability in function sco_sock_sendmsg()

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 20 more
CVE-2021-3635

kernel: flowtable list del corruption with kernel BUG at lib/list_debug.c:50

A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root (CAP_SYS_ADMIN) access is able to panic the system when issuing netfilter netflow commands.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux
CVE-2021-3612

kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP()

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 3 more
Products
Debian Linux Fedora Linux Kernel and 23 more
CVE-2021-3609

kernel: race condition in net/can/bcm.c leads to local privilege escalation

.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel H300e H300e Firmware and 43 more
CVE-2021-3600

kernel: eBPF 32-bit source register truncation on div/mod

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 1 more
Products
Ubuntu Linux Fedora Linux Kernel and 1 more
CVE-2021-3573

kernel: use-after-free in function hci_sock_bound_ioctl()

A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 1 more
CVE-2021-3571

linuxptp: wrong length of one-step follow-up in transparent clock

A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.

CVSS 3.1 · 7.1 High EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Linuxptp Project Redhat
Products
Fedora Linuxptp Enterprise Linux
CVE-2021-3570

linuxptp: missing length check of forwarded messages

A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Debian Fedoraproject Linuxptp Project and 1 more
Products
Debian Linux Fedora Linuxptp and 5 more
CVE-2021-3564

kernel: double free in bluetooth subsystem when the HCI device initialization fails

A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 2 more
CVE-2021-3551

pki-server: Dogtag installer "pkispawn" logs admin credentials into a world-readable log file

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Dogtagpki Fedoraproject Oracle and 1 more
Products
Dogtagpki Fedora Linux and 9 more
CVE-2021-3501

kernel: userspace applications can misuse the KVM API to cause a write of 16 bytes at an offset up to 32 GB from vcpu->run

A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Netapp and 1 more
Products
Fedora Linux Kernel Cloud Backup and 25 more
CVE-2021-3489

Linux kernel eBPF RINGBUF map oversized allocation

The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2021-3428

kernel: integer overflow in ext4_es_cache_extent

A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2021-3411

kernel: broken KRETPROBES reports corruption of .text section while running a FTRACE stress tester

A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2021-3348

kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c

nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux
CVE-2021-38201

kernel: slab-out-of-bounds access in xdr_set_page_base() in net/sunrpc/xdr.c

net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Element Software Hci Bootstrap Os and 5 more
CVE-2021-37576

kernel: powerpc: KVM guest OS users can cause host OS memory corruption

arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 4 more
CVE-2021-33909

kernel: size_t-to-int conversion vulnerability in the filesystem layer

fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.

CVSS 3.1 · 7.8 High EPSS 9.8% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 4 more
Products
Debian Linux Fedora Linux Kernel and 13 more