CVE-2021-3611

QEMU: intel-hda: segmentation fault due to stack overflow

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2021-3609

kernel: race condition in net/can/bcm.c leads to local privilege escalation

.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300e H300e Firmware and 43 more

CVE-2021-3605

OpenEXR: Heap buffer overflow in the rleUncompress function

There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Openexr Redhat

Products

Debian Linux Openexr Enterprise Linux

CVE-2021-3602

buildah: Host environment variables leaked in build container when using chroot isolation

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Buildah Project Redhat

Products

Buildah Enterprise Linux Enterprise Linux For Ibm Z Systems and 1 more

CVE-2021-3600

kernel: eBPF 32-bit source register truncation on div/mod

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Fedoraproject Linux and 1 more

Products

Ubuntu Linux Fedora Linux Kernel and 1 more

CVE-2021-3598

OpenEXR: Heap buffer overflow in Imf_3_1::CharPtrIO::readChars

There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Openexr Redhat

Products

Debian Linux Openexr Enterprise Linux

CVE-2021-3597

undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.

CVSS 3.1 · 5.9 Medium EPSS 1.2% KEV · Not listed

Vendors

Netapp Redhat

Products

Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 9 more

CVE-2021-3596

ImageMagick: NULL pointer dereference in ReadSVGImage() in coders/svg.c

A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Fedoraproject Imagemagick and 1 more

Products

Debian Linux Fedora Imagemagick and 1 more

CVE-2021-3595

QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Libslirp Project and 1 more

Products

Debian Linux Fedora Libslirp and 1 more

CVE-2021-3594

QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Libslirp Project and 1 more

Products

Debian Linux Fedora Libslirp and 1 more

CVE-2021-3593

QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Libslirp Project and 1 more

Products

Debian Linux Fedora Libslirp and 1 more

CVE-2021-3592

QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Libslirp Project and 1 more

Products

Debian Linux Fedora Libslirp and 1 more

CVE-2021-3573

kernel: use-after-free in function hci_sock_bound_ioctl()

A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Redhat

Products

Fedora Linux Kernel Enterprise Linux and 1 more

CVE-2021-3571

linuxptp: wrong length of one-step follow-up in transparent clock

A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.

CVSS 3.1 · 7.1 High EPSS 1.9% KEV · Not listed

Vendors

Fedoraproject Linuxptp Project Redhat

Products

Fedora Linuxptp Enterprise Linux

CVE-2021-3570

linuxptp: missing length check of forwarded messages

A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed

Vendors

Debian Fedoraproject Linuxptp Project and 1 more

Products

Debian Linux Fedora Linuxptp and 5 more

CVE-2021-3569

libtpms: stack corruption bug in RSA decryption

A stack corruption bug was found in libtpms in versions before 0.7.2 and before 0.8.0 while decrypting data using RSA. This flaw could result in a SIGBUS (bad memory access) and termination of swtpm. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Libtpms Project Redhat

Products

Libtpms Enterprise Linux

CVE-2021-3565

tpm2-tools: fixed AES wrapping key in tpm2_import

A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.9 Medium EPSS 1.3% KEV · Not listed

Vendors

Fedoraproject Redhat Tpm2-tools Project

Products

Fedora Enterprise Linux Tpm2-tools

CVE-2021-3564

kernel: double free in bluetooth subsystem when the HCI device initialization fails

A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 2 more

CVE-2021-3551

pki-server: Dogtag installer "pkispawn" logs admin credentials into a world-readable log file

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Dogtagpki Fedoraproject Oracle and 1 more

Products

Dogtagpki Fedora Linux and 9 more

CVE-2021-3543

kernel: nitro_enclaves stale file descriptors on failed usercopy

A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave file descriptor. A local user of a host machine could use this flaw to crash the system or escalate their privileges on the system.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Nitro Enclaves Project Redhat

Products

Fedora Nitro Enclaves Enterprise Linux